detect/analyzer: add more details for tcp_seq - v2

[0xEniola]

Link to redmine ticket: https://redmine.openinfosecfoundation.org/issues/6353

Previous PR: #9676

Describe changes:

• Modify the commit message subject to comply with project's 50 character limit.

Output:

{
    "raw":"alert tcp any any -> any any (msg:\"Testing seq\"; seq:723833; sid:2;)",
    "id":2,
    "gid":1,
    "rev":0,
    "msg":"Testing seq",
    "app_proto":"unknown",
    "requirements":[],
    "type":"pkt",
    "flags": [
        "src_any",
        "dst_any",
        "sp_any",
        "dp_any",
        "need_packet",
        "toserver",
        "toclient"
    ],
    "pkt_engines": [
        {
            "name":"packet",
            "is_mpm":false
        }
    ],
    "frame_engines": [],
    "lists": {
        "packet": {
            "matches": [
                {
                    "name":"tcp.seq",
                    "seq": {
                        "number":723833
                    }
                }
            ]
        }
    }
}

SV_BRANCH=OISF/suricata-verify#1435

[github-actions]

NOTE: This PR may contain new authors:

Daniel Olatunji <[email protected]>

[inashivb]

LGTM. Thanks! :)

[jasonish]

An approval for me, but just wanted to drop a note that its a little odd that the name logged is "tcp.seq", but the new object is just "seq". But we can't use "tcp.seq" as an object name as downstream tools will break.

So as we add more "tcp.XXX" fields, we may want to refactor to group them under another object, but that gets complicated quickly.

[0xEniola]

An approval for me, but just wanted to drop a note that its a little odd that the name logged is "tcp.seq", but the new object is just "seq". But we can't use "tcp.seq" as an object name as downstream tools will break.

So as we add more "tcp.XXX" fields, we may want to refactor to group them under another object, but that gets complicated quickly.

Actually, the name were met that way in their source file, so I couldn't do anything about that.

But I do understand what you mean.

[jasonish]

An approval for me, but just wanted to drop a note that its a little odd that the name logged is "tcp.seq", but the new object is just "seq". But we can't use "tcp.seq" as an object name as downstream tools will break.
So as we add more "tcp.XXX" fields, we may want to refactor to group them under another object, but that gets complicated quickly.

Actually, the name were met that way in their source file, so I couldn't do anything about that.

But I do understand what you mean.

Yeah, doing anything more about it becomes a larger refactoring I think outside the scope of this one ticket.

[jufajardini]

Adding the decision-required label here so we consider what Jason has mention before deciding if ready to merge or not.

[catenacyber]

Needs a rebase