Project

General

Profile

Actions
Copy link

Feature #385

closed

Configuration option to log all known (pcap) data for a stream when an alert fires

Added by David Wharton almost 13 years ago. Updated almost 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Community Ticket
Target version:
TBD
Effort:
Difficulty:
Label:

Description

This is a request to be able to configure Suricata to log as much of a stream that it can leading up to an alert. For example, if an alert is generated, this configuration directive would tell Suricata to log as much of the stream that it knows about (e.g. what is in memory) up until and including the data that caused the alert, to disk. Data after an alert can be set by tagging directives but I think it would be handy to be able to configure Suricata to log all traffic it has in memory for a stream that generates an alert. Logging of network data would of course be in libpcap format (see also Feature #384 -- https://redmine.openinfosecfoundation.org/issues/384).

Related issues 4 (2 open — 2 closed)

Related to Suricata - Task #2309: SuriCon 2017 brainstormAssignedVictor JulienActions
Related to Suricata - Task #2219: Save pcap only if alertRejectedActions
Related to Suricata - Task #2685: SuriCon 2018 brainstormAssignedVictor JulienActions
Is duplicate of Suricata - Feature #120: Capture full session on alertClosedScott JordanActions
Actions
Copy link
 #1

Updated by Victor Julien over 12 years ago

  • Assignee set to OISF Dev
  • Priority changed from Low to Normal
  • Target version set to TBD

In case of an alert generated based on the application layer state (e.g. HTTP), this is already what we do in Unified2. For raw stream alerts we can probably try to do that as well.

Actions
Copy link
 #2

Updated by Victor Julien almost 7 years ago

  • Related to Task #2309: SuriCon 2017 brainstorm added
Actions
Copy link
 #3

Updated by Victor Julien over 6 years ago

  • Related to Feature #120: Capture full session on alert added
Actions
Copy link
 #4

Updated by Victor Julien over 6 years ago

  • Related to Task #2219: Save pcap only if alert added
Actions
Copy link
 #5

Updated by Raymond Hansen almost 6 years ago

  • Assignee changed from OISF Dev to Maurizio Abba
Actions
Copy link
 #6

Updated by Victor Julien almost 6 years ago

  • Related to Task #2685: SuriCon 2018 brainstorm added
Actions
Copy link
 #7

Updated by Victor Julien over 5 years ago

Hi Maurizio, are you still planning to submit a PR for this?

Actions
Copy link
 #8

Updated by Victor Julien about 5 years ago

  • Assignee changed from Maurizio Abba to Community Ticket
Actions
Copy link
 #9

Updated by Andreas Herz almost 5 years ago

  • Status changed from New to Closed

Issue #120 is the same but less specific

Actions
Copy link
 #10

Updated by Victor Julien almost 5 years ago

  • Related to deleted (Feature #120: Capture full session on alert)
Actions
Copy link
 #11

Updated by Victor Julien almost 5 years ago

  • Is duplicate of Feature #120: Capture full session on alert added
Actions
Copy link

Also available in: Atom PDF