Project

General

Profile

Actions

Documentation #6478

open

schema: add missing fields

Added by Philippe Antoine about 1 year ago. Updated about 2 months ago.

Status:
New
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Beginner, Good First Issue, Outreachy

Description

With the addition of the JSON schema (see https://github.com/OISF/suricata/blob/master/etc/schema.json) and SV checks to validate it, it's important to ensure that it is complete.

Running git grep set_string rust/src/ | cut -d'"' -f2 | sort | uniq | grep -v : | while read i; do echo -n $i; git grep $i etc/schema.json | wc -l; done | awk '$2 == 0'

shows for instance that server_security_failure_reason is missing in etc/schema.json for rfb


Subtasks 3 (1 open2 closed)

Task #7287: schema: add missing tls fields certificate and chainClosedJuliana Fajardini ReichowActions
Task #7288: schema: add missing tls fields certificate and chain (7.0.x backport)ClosedJuliana Fajardini ReichowActions
Documentation #7298: schema/netflow: add missing fieldNewCommunity TicketActions

Related issues 5 (5 open0 closed)

Related to Suricata - Task #6443: Suricon 2023 brainstormAssignedVictor JulienActions
Related to Suricata - Task #6463: eve/output: investigate how to track coverage / parityNewOISF DevActions
Related to Suricata - Optimization #6502: schema: avoid - and . in keysNewOISF DevActions
Related to Suricata - Documentation #6566: userguide: add description for missing EVE krb fieldsNewOISF DevActions
Related to Suricata - Story #6597: rules: improve rules keyword/output parityNewVictor JulienActions
Actions #1

Updated by Philippe Antoine about 1 year ago

  • Related to Task #6443: Suricon 2023 brainstorm added
Actions #2

Updated by Philippe Antoine about 1 year ago

  • Label Beginner added
Actions #3

Updated by Juliana Fajardini Reichow about 1 year ago

  • Label Good First Issue, Outreachy added
Actions #4

Updated by Victor Julien about 1 year ago

  • Related to Task #6463: eve/output: investigate how to track coverage / parity added
Actions #5

Updated by Juliana Fajardini Reichow about 1 year ago

  • Subject changed from schema completion to schema: add missing fields
  • Description updated (diff)
  • Assignee changed from OISF Dev to Community Ticket
  • Target version changed from TBD to 8.0.0-beta1
Actions #6

Updated by Philippe Antoine about 1 year ago

Actions #7

Updated by Juliana Fajardini Reichow about 1 year ago

Actions #8

Updated by Juliana Fajardini Reichow about 1 year ago

  • Related to Story #6597: rules: improve rules keyword/output parity added
Actions #9

Updated by Philippe Antoine about 1 year ago

Another quick idea : use fuzz corpus turned into pcaps to get a big eve.json and then try jsonschema on it

Actions #10

Updated by Victor Julien 6 months ago

  • Target version changed from 8.0.0-beta1 to TBD
Actions #11

Updated by Juliana Fajardini Reichow 3 months ago

  • Subtask #7287 added
Actions #12

Updated by Juliana Fajardini Reichow 3 months ago

  • Subtask #7298 added
Actions

Also available in: Atom PDF