4 Commits (master)

Author	SHA1	Message	Date
Eric Leblond	dd94dc6cc6	datajson: introduce feature ... This patch introduces new option to dataset keyword. Where regular dataset allows match from sets, dataset with json format allows the same but also adds JSON data to the alert event. This data is coming from the set definition it self. For example, an ipv4 set will look like: [{"ip": "10.16.1.11", "test": "success","context":3}] The syntax is a JSON array but it can also be a JSON object with an array inside. The idea is to directly used data coming from the API of a threat intel management software. The syntax of the keyword is the following: dataset:isset,src_ip,type ip,load src.lst,format json, \ enrichment_key src_ip, value_key ip; Compare to dataset, it just have a supplementary option key that is used to indicate in which subobject the JSON value should be added. The information is added in the even under the alert.extra subobject: "alert": { "extra": { "src_ip": { "ip": "10.6.1.11", "test": "success", "context": 3 }, The main interest of the feature is to be able to contextualize a match. For example, if you have an IOC source, you can do [ {"buffer": "value1", "actor":"APT28","Country":"FR"}, {"buffer": "value2", "actor":"APT32","Country":"NL"} ] This way, a single dataset is able to produce context to the event where it was not possible before and multiple signatures had to be used. The format introduced in datajson is an evolution of the historical datarep format. This has some limitations. For example, if a user fetch IOCs from a threat intel server there is a large change that the format will be JSON or XML. Suricata has no support for the second but can support the first one. Keeping the key value may seem redundant but it is useful to have it directly accessible in the extra data to be able to query it independantly of the signature (where it can be multiple metadata or even be a transformed metadata). In some case, when interacting with data (mostly coming from threat intel servers), the JSON array containing the data to use is not at the root of the object and it is ncessary to access a subobject. This patch implements this with support of key in level1.level2. This is done via the `array_key` option that contains the path to the data. Ticket: #7372	1 month ago
Jason Ish	1aaf5cb7d2	rust: allow some lints in suricatactl and suricatasc ... These are lints we allow in the Suricata Rust source code for style reasons.	1 month ago
Jason Ish	89ba53272c	suricatasc: reconnect on loss of connection ... If the connection is lost (for example, Suricata is restarted), try to re-open the connect and re-execute the command. This was the behavior of the Python implementation. Ticket: #7746	1 month ago
Jason Ish	8115669602	suricatasc: a Rust implementation of suricatasc ... This is a re-implementation of suricatasc program in Rust that attempts to be a 100% drop-in replacement.	5 months ago