Project

General

Profile

Actions

Feature #8516

open
JI OD

http: include server header in default eve record as a field

Feature #8516: http: include server header in default eve record as a field

Added by Jason Ish 23 days ago. Updated 16 days ago.

Status:
Triaged
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Currently, to get the server header field, you need to dump all headers and extract it from the array. As the server header is commonly used, it makes sense to hoist it up like the user-agent and content-type.


Related issues 3 (2 open1 closed)

Related to Suricata - Bug #6173: http: loss of backward compatibility in HTTP logs from v6 to v7NewOISF DevActions
Related to Suricata - Task #8549: http: consider making extended the defaultFeedbackJason IshActions
Copied to Suricata - Feature #8520: quic: include server header in default eve record as a field RejectedOISF DevActions

JI Updated by Jason Ish 23 days ago Actions #1

  • Related to Bug #6173: http: loss of backward compatibility in HTTP logs from v6 to v7 added

PA Updated by Philippe Antoine 23 days ago Actions #2

  • Status changed from New to Assigned
  • Target version changed from TBD to 9.0.0-beta1

JI Updated by Jason Ish 23 days ago Actions #3

  • Copied to Feature #8520: quic: include server header in default eve record as a field added

PA Updated by Philippe Antoine 22 days ago Actions #4

  • Status changed from Assigned to Triaged

JI Updated by Jason Ish 17 days ago Actions #5

@eleblond @Peter Manev Any thoughts on how to handle the case where there are multiple server headers? We do not handle this for the user agent, either the first or last wins (I'm not sure which). So we could either do:

"http_server": "Caddy" 

or
"http_server": ["Caddy", "nginx"]

in the case where you had the server being run by some joker.

EL Updated by Eric Leblond 16 days ago Actions #6

Jason Ish wrote in #note-5:

@eleblond @Peter Manev Any thoughts on how to handle the case where there are multiple server headers? We do not handle this for the user agent, either the first or last wins (I'm not sure which). So we could either do:
[...]
or
[...]
in the case where you had the server being run by some joker.

I would propose to handle it the way we do user agent (one single string), and get a weirdness proof output in the "name,value" part of log.

JI Updated by Jason Ish 14 days ago Actions #7

  • Related to Task #8549: http: consider making extended the default added
Actions

Also available in: PDF Atom