alert/eve: add snmp metadata for snmp alerts

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/3441
pull/5276/head
Jason Ish 5 years ago committed by Victor Julien
parent 4c7f55e636
commit ef0ebc9550

@ -219,6 +219,20 @@ static void AlertJsonDns(const Flow *f, const uint64_t tx_id, JsonBuilder *js)
return;
}
static void AlertJsonSNMP(const Flow *f, const uint64_t tx_id, JsonBuilder *js)
{
void *snmp_state = (void *)FlowGetAppState(f);
if (snmp_state != NULL) {
void *tx = AppLayerParserGetTx(f->proto, ALPROTO_SNMP, snmp_state,
tx_id);
if (tx != NULL) {
jb_open_object(js, "snmp");
rs_snmp_log_json_response(js, snmp_state, tx);
jb_close(js);
}
}
}
static void AlertJsonSourceTarget(const Packet *p, const PacketAlert *pa,
JsonBuilder *js, JsonAddrInfo *addr)
{
@ -483,6 +497,9 @@ static void AlertAddAppLayer(const Packet *p, JsonBuilder *jb,
jb_restore_mark(jb, &mark);
}
break;
case ALPROTO_SNMP:
AlertJsonSNMP(p->flow, tx_id, jb);
break;
default:
break;
}

Loading…
Cancel
Save