Feature #8779
openlist all fields produced by suricata
Description
In a very similar manner we have
suricata --list-keywords
It will be useful if we can also have possibility to list all the fields produced by Suricata, not just keywords.
Being able to do something like so:
suricata --list-keywords=smb suricata --list-keywords=all
Will be useful for an end user to confirm if a field is available in Suricata for logging not just the keyword for a rule.
PM Updated by Peter Manev 23 days ago
I gave the example before with "keywords" as a reference , but we should name it something maybe like
suricata --list-fields=smb
VJ Updated by Victor Julien 22 days ago
- Status changed from New to Feedback
- Target version changed from 9.0.0 to TBD
I think the best way to do this would be to use the schema as the source of this. Unlike the keywords, the logged fields are not registered anywhere, so maintaining a table like this would be a manual step for each field. Since we're already doing that for the schema, I think it makes sense to just use that.
JI Updated by Jason Ish 15 days ago
Related, we have this in the documentation, for example: https://docs.suricata.io/en/suricata-8.0.6/appendix/eve-index.html#smb-object