Project

General

Profile

Actions
Copy link

Feature #4175

open

dcerpc: higher level logging

Added by Victor Julien almost 4 years ago.

Status:
New
Priority:
Normal
Assignee:
Community Ticket
Target version:
TBD
Effort:
Difficulty:
Label:

Description

At the 2020 brainstorm it was suggested that the DCERPC logging would support a higher level logging, as both dcerpc and smb can be very verbose. Zeek was mentioned as an example to look at. Concern was that it might hide evasion attempts.

A good start would be to get some examples.

Related issues 3 (2 open — 1 closed)

Related to Suricata - Task #4097: Suricon 2020 brainstormAssignedVictor JulienActions
Related to Suricata - Feature #5413: DCERPC logging is not easy to use in analysisClosedEric LeblondActions
Related to Suricata - Feature #4213: smb: higher level loggingNewOISF DevActions
Actions
Copy link
 #1

Updated by Victor Julien almost 4 years ago

  • Related to Task #4097: Suricon 2020 brainstorm added
Actions
Copy link
 #2

Updated by Victor Julien over 2 years ago

  • Related to Feature #5413: DCERPC logging is not easy to use in analysis added
Actions
Copy link
 #3

Updated by Jason Ish 5 months ago

Actions
Copy link

Also available in: Atom PDF