Actions
Feature #8779
open
PM
list all fields produced by suricata
Feature #8779:
list all fields produced by suricata
Effort:
Difficulty:
Label:
Description
In a very similar manner we have
suricata --list-keywords
It will be useful if we can also have possibility to list all the fields produced by Suricata, not just keywords.
Being able to do something like so:
suricata --list-keywords=smb suricata --list-keywords=all
Will be useful for an end user to confirm if a field is available in Suricata for logging not just the keyword for a rule.
PM Updated by Peter Manev about 21 hours ago
I gave the example before with "keywords" as a reference , but we should name it something maybe like
suricata --list-fields=smb
VJ Updated by Victor Julien about 4 hours ago
- Status changed from New to Feedback
- Target version changed from 9.0.0 to TBD
I think the best way to do this would be to use the schema as the source of this. Unlike the keywords, the logged fields are not registered anywhere, so maintaining a table like this would be a manual step for each field. Since we're already doing that for the schema, I think it makes sense to just use that.
Actions