Actions
Feature #8335
openpgsql: add keywords for better detection and coverage
Effort:
Difficulty:
Label:
Description
We have PostgreSQL/pgsql protocol logging - it is great to have it in the SIEM and doing visualizations with it.
While i as doing that a few thing made an impression on me that we could add key words in order to trigger an alert (not just have it as protocol data being logged).
We could use some keywords for the below:
pgsql.request.protocol_version pgsql.response.parameter_status.is_superuser pgsql.request.startup_parameters.user pgsql.request.startup_parameters.optional_parameters.database pgsql.response.authentication_md5_password
The idea is to highlight weak or clear text password , miscconfiguration also match on a field - if it exists or if it has specific content.
This is very valuable especially from the perspective if the communication is North/South.
Screenshot attached is simple list form Kibana for reference.
Would be great if this can be done in Suricata 8 , not just 9.
Files
Updated by Juliana Fajardini Reichow about 8 hours ago
- Subject changed from add keywords for better pgsql detection and coverage to pgsql: add keywords for better detection and coverage
- Status changed from New to Assigned
- Assignee set to Juliana Fajardini Reichow
- Target version changed from TBD to 9.0.0-beta1
Actions