Project

General

Profile

Actions

Task #6308

open

detect/analyzer: add more keyword details

Added by Juliana Fajardini Reichow about 1 year ago. Updated 3 days ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:
Beginner, Good First Issue, Outreachy

Description

This is an umbrella ticket.

When running Suricata with --engine-analysis mode (https://docs.suricata.io/en/latest/command-line-options.html?highlight=engine%20analysis#cmdoption-engine-analysis), the engine generates a profile report on whatever rules it had as input. See more at https://docs.suricata.io/en/latest/configuration/suricata-yaml.html?highlight=engine-analysis#engine-analysis.

The purpose of this task is to improve the said report, specifically the `postmatch` section, which expands the keyword matches for each rule.

The main goal is to expose the keyword's properties for a JSON object in the key-value format.

The keyword will have corresponding source files that will help you know what is the keyword name recognized by the engine, as well as the other fields we are interested in exposing to the engine analysis report.

The details about the keyword should be used to create the JSON object, named after the keyword you're working with.
The JsonBuilder will have the needed functions for that.

Feel free to use the listed PR here, as well as existing code in detect-engine-analyzer.c function DumpMatches, as examples.

This commit shows an example for adding details for byte_test and byte_jump - https://github.com/OISF/suricata/pull/8625/commits/325000ca2bd72edd802122a3d25988183622a69f

This PR contains work for adding details to the `ipopts` keyword: https://github.com/OISF/suricata/pull/9487
please note how the PR also links a Suricata-verify related work for testing the new output: https://github.com/OISF/suricata-verify/pull/1387


Subtasks 16 (9 open7 closed)

Task #6309: detect/analyzer: add more details for the flowbits keywordClosedHadiqa Alamdar BukhariActions
Task #6310: detect/analyzer: add more details for the ttl keywordNewCommunity TicketActions
Task #6311: detect/analyzer: add more details for the flowint keywordNewCommunity TicketActions
Task #6312: detect/analyzer: add more details for the flow.age keywordClosedAlice da Silva AkakiActions
Task #6348: detect/analyzer: add more details for the ipopts keywordClosedJuliana Fajardini ReichowActions
Task #6350: detect/analyzer: add more details for the tcp.flags keywordNewCommunity TicketActions
Task #6351: detect/analyzer: add more details for the xbits keywordNewCommunity TicketActions
Task #6352: detect/analyzer: add more details for the tcp window keywordIn ReviewNancy EnosActions
Task #6353: detect/analyzer: add more details for the tcp seq keywordClosedDaniel OlatunjiActions
Task #6354: detect/analyzer: add more details for the tcp ack keywordClosedDaniel OlatunjiActions
Task #6355: detect/analyzer: add more details for the tcp.mss keywordClosedDaniel OlatunjiActions
Task #6356: detect/analyzer: add more details for the tcp.hdr keywordNewCommunity TicketActions
Task #6357: detect/analyzer: add more details for the dsize keywordNewCommunity TicketActions
Task #6358: detect/analyzer: add more details for the ICMP itype keywordAssignedCommunity TicketActions
Task #6359: detect/analyzer: add more details for the ICMP icode keywordNewCommunity TicketActions
Task #6360: detect/analyzer: add more details for the icmp_id keywordClosedAlice da Silva AkakiActions
Actions #1

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subtask #6309 added
Actions #2

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subtask #6310 added
Actions #3

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subtask #6311 added
Actions #4

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subtask #6312 added
Actions #5

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subtask #6348 added
Actions #6

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subtask #6350 added
Actions #7

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subtask #6351 added
Actions #8

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subtask #6352 added
Actions #9

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subtask #6353 added
Actions #10

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subtask #6354 added
Actions #11

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subtask #6355 added
Actions #12

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subtask #6356 added
Actions #13

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subtask #6357 added
Actions #14

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subtask #6358 added
Actions #15

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subtask #6359 added
Actions #16

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subtask #6360 added
Actions #17

Updated by Juliana Fajardini Reichow about 1 year ago

  • Description updated (diff)
Actions #18

Updated by Juliana Fajardini Reichow about 1 year ago

  • Description updated (diff)
Actions #19

Updated by Juliana Fajardini Reichow 3 days ago

  • Target version changed from 8.0.0-beta1 to 8.0.0
Actions

Also available in: Atom PDF