detect: log app-layer metadata in alert with single tx v5 #12168
Conversation
Ticket: 7199 Uses a config parameter detect.force-applayer-findtx to enable this behavior (off by default) This feature is requested for use cases with signatures not using app-layer keywords but still targetting application layer transactions, such as pass/drop rule combination, or lua usage. This overrides the previous behavior of checking if the signature has a content match, by checking if there is only one live transaction, in addition to the config parameter being set.
catenacyber
requested review from
jufajardini,
victorjulien and
a team
as code owners
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #12168 +/- ##
==========================================
- Coverage 49.81% 45.33% -4.49%
==========================================
Files 909 909
Lines 257904 257736 -168
==========================================
- Hits 128467 116832 -11635
- Misses 129437 140904 +11467
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
WARNING:
Pipeline 23591 |
| The alert event will have ``"tx_id_forced": true`` to recognize | ||
| these alerts. |
There was a problem hiding this comment.
Pondering on the name here (as it will be used in the log output).
tx_match_forced? tx_logged_forced?
There was a problem hiding this comment.
match has too much meaning with rule matching in Suricata-language, so I'd avoid that.
|
Are we only logging in the case there is one TX? |
Yes logging if one tx and config parameter set Please give me better names :-) |
| # try to find an app-layer transaction for rules without app-layer keywords | ||
| # allows to log app-layer metadata in alert | ||
| # but the transaction may not be the relevant one. | ||
| # force-applayer-findtx: no |
There was a problem hiding this comment.
Yeah... I am not sure.
This is the detect engine doing the work here, not the logging...
|
Next in #12195 |
Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/7199
May also solve https://redmine.openinfosecfoundation.org/issues/7406 and https://redmine.openinfosecfoundation.org/issues/7350
Describe changes:
SV_BRANCH=OISF/suricata-verify#2146
#12166 with big changes
detect.force-applayer-findtxtx_id_forced: truein such casesPACKET_ALERT_FLAG_STREAM_MATCHas overridden by the new one : one live tx + config okAnswering #12166 (comment) :
I think/fear that for every protocol, there does not exist a condition robust enough to provide the relevant tx for all use cases = set of rules + people expectations
Do you have such a condition ?
I think there is quite a demand to log something, and since I think we cannot be always right, we can ask the user to turn on some configuration parameter to ask for it