output/reference: Include reference information in alert (if configured) #11767
Conversation
Issue: 4974 Optionally include rule references with the alert. Since there can be multiple reference keywords, they are collected into an array.
Issue: 4974
Issue: 4974
1. Use https instead of http everywhere
2. Organize and annotate references by
- Referenced by ET/Open and ET/Pro
- URL resolves and works as intended (to provide supplemental
information regarding a reference value, e.g., bug id, cve
value)
- URL no longer resolves
- URL resolves but doesn't work as intended (to provide
supplemental information)
- Not referenced by ET/Open nor ET/Pro
- URL resolves and works as intended (to provide supplemental
information regarding a reference value, e.g., bug id, cve
value)
- URL no longer resolves
- URL resolves but doesn't work as intended (to provide
supplemental information)
Issue: 4974 Remove unused parameters in output path for - AlertJsonMetadata - AlertJsonHeader
jlucovsky
requested review from
jufajardini,
victorjulien and
a team
as code owners
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #11767 +/- ##
==========================================
- Coverage 82.62% 82.53% -0.09%
==========================================
Files 919 919
Lines 248979 249007 +28
==========================================
- Hits 205722 205529 -193
- Misses 43257 43478 +221
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
Information: QA ran without warnings. Pipeline 22591 |
| const size_t size_needed = kv->key_len + kv->reference_len + 1; | ||
| char kv_store[size_needed]; | ||
| snprintf(kv_store, size_needed, "%s%s", kv->key, kv->reference); | ||
| jb_append_string(jb, kv_store); |
There was a problem hiding this comment.
thought: would it make sense to add a jb_append_printf-ish function that would take a format string? It would also perhaps allow dropping the stack buffer, although I'm not sure if that would just move to the jb_... func instead or can be avoided completely.
There was a problem hiding this comment.
There are 8 places where jb_append_printf (or jb_set_printf) would be useful.
I used git grep -B 5 -e jb_set_string -e jb_append_string|grep snprintf -A 3
|
Merged in #11792, thanks! |
Continuation of #11758
When configured, include the reference value in the alert. The configuration value is in the
alertsection: types.alert.reference. The default value is off/no. Set to yes to include the expanded reference from the rule in the alert record.Link to redmine ticket: 4974
Describe changes:
referencevalue to suricata.yaml.in (default no/off)references: [ "ref-1" [, "ref-2" [, ...]]]Updates:
BUG_ONchecks when using reference key/values.Provide values to any of the below to override the defaults.
SV_BRANCH=OISF/suricata-verify#2037