Project

General

Profile

Actions

Bug #6983

closed

alert/metadata: no pgsql object encapsulation

Added by Juliana Fajardini Reichow 6 months ago. Updated about 2 months ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

When adding a fix for #6092 I didn't take into consideration that the EVE object for pgsql is actually created outside of rs_pgsql_logger, which leads to the alert metadata being created without the pgsql object encapsulation:

  "alert": {
    "action": "allowed",
    "gid": 1,
    "signature_id": 1,
    "rev": 1,
    "signature": "PGSQL Test Rule",
    "category": "",
    "severity": 3
  },
  "request": {
    "simple_query": "select * from rules where sid = 2021701;" 
  },
  "response": {
    "field_count": 10,
    "data_rows": 3,
    "data_size": 1104,
    "command_completed": "SELECT 3" 
  },

Now, this must to be fixed.


Subtasks 1 (0 open1 closed)

Bug #7066: alert/metadata: no pgsql object encapsulation (7.0.x backport)ClosedJuliana Fajardini ReichowActions

Related issues 1 (0 open1 closed)

Related to Suricata - Bug #6092: eve/alert: missing pgsql metadataClosedJuliana Fajardini ReichowActions
Actions #1

Updated by Juliana Fajardini Reichow 6 months ago

  • Subject changed from alert/metadata: no pgsql object created to alert/metadata: no pgsql object encapsulation
Actions #2

Updated by Juliana Fajardini Reichow 6 months ago

  • Related to Bug #6092: eve/alert: missing pgsql metadata added
Actions #3

Updated by Juliana Fajardini Reichow 6 months ago

  • Status changed from In Progress to In Review
Actions #4

Updated by Juliana Fajardini Reichow 5 months ago

  • Status changed from In Review to Resolved
  • Label Needs backport to 7.0 added
Actions #5

Updated by OISF Ticketbot 5 months ago

  • Subtask #7066 added
Actions #6

Updated by OISF Ticketbot 5 months ago

  • Label deleted (Needs backport to 7.0)
Actions #7

Updated by Juliana Fajardini Reichow about 2 months ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF