eve/alert: include rule text in alert output #2881

rs-natano · 2017-08-23T08:00:05Z

Make sure these boxes are signed before submitting your Pull Request -- thank you.

I have read the contributing guide lines at https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Contributing
I have signed the Open Information Security Foundation contribution agreement at https://suricata-ids.org/about/contribution-agreement/
I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable)

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/2020

Describe changes:

For SIEM analysis it is often useful to refer to the actual rules to find out why a specific alert has been triggered when the signature message does not convey enough information.

Turn on the new rule flag to include the rule text in eve alert output. The feature is turned off by default.

With a rule like this:

alert dns $HOME_NET any -> 8.8.8.8 any (msg:"Google DNS server contacted"; sid:42;)

The eve alert output might look something like this (pretty-printed for readability):

{
  "timestamp": "2017-08-14T12:35:05.830812+0200",
  "flow_id": 1919856770919772,
  "in_iface": "eth0",
  "event_type": "alert",
  "src_ip": "10.20.30.40",
  "src_port": 50968,
  "dest_ip": "8.8.8.8",
  "dest_port": 53,
  "proto": "UDP",
  "alert": {
    "action": "allowed",
    "gid": 1,
    "signature_id": 42,
    "rev": 0,
    "signature": "Google DNS server contacted",
    "category": "",
    "severity": 3,
    "rule": "alert dns $HOME_NET any -> 8.8.8.8 any (msg:\"Google DNS server contacted\"; sid:43;)"
  },
  "app_proto": "dns",
  "flow": {
    "pkts_toserver": 1,
    "pkts_toclient": 0,
    "bytes_toserver": 81,
    "bytes_toclient": 0,
    "start": "2017-08-14T12:35:05.830812+0200"
  }
}

For SIEM analysis it is often useful to refer to the actual rules to find out why a specific alert has been triggered when the signature message does not convey enough information. Turn on the new rule flag to include the rule text in eve alert output. The feature is turned off by default. With a rule like this: alert dns $HOME_NET any -> 8.8.8.8 any (msg:"Google DNS server contacted"; sid:42;) The eve alert output might look something like this (pretty-printed for readability): { "timestamp": "2017-08-14T12:35:05.830812+0200", "flow_id": 1919856770919772, "in_iface": "eth0", "event_type": "alert", "src_ip": "10.20.30.40", "src_port": 50968, "dest_ip": "8.8.8.8", "dest_port": 53, "proto": "UDP", "alert": { "action": "allowed", "gid": 1, "signature_id": 42, "rev": 0, "signature": "Google DNS server contacted", "category": "", "severity": 3, "rule": "alert dns $HOME_NET any -> 8.8.8.8 any (msg:\"Google DNS server contacted\"; sid:43;)" }, "app_proto": "dns", "flow": { "pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 81, "bytes_toclient": 0, "start": "2017-08-14T12:35:05.830812+0200" } } Feature OISF#2020

jasonish · 2017-08-23T20:54:55Z

src/detect-parse.c

@@ -1071,7 +1071,10 @@ int SigParse(DetectEngineCtx *de_ctx, Signature *s, const char *sigstr, uint8_t
    SignatureParser parser;
    memset(&parser, 0x00, sizeof(parser));

-    s->sig_str = sigstr;
+    s->sig_str = SCStrdup(sigstr);


This will leak if SigParseBasics fails to parse the rule.

No. The only caller of SigParse() calls SigFree() in case the function returned an error. See https://github.com/rs-natano/suricata/blob/9af2e9a50cfdb9d75d206614a8e3b03cb8486590/src/detect-parse.c#L1644 . SigFree() also frees sig_str when not NULL. Note that all other dynamically allocated members of the signature struct are handled in the same way (class_msg, sp, dp, ...); otherwise the cleanup code would be much more complex.

Makes sense?

Yes, it does. Took too much of a micro-look at the patch.

jasonish · 2017-08-23T20:56:24Z

src/detect-parse.c

@@ -1100,8 +1103,6 @@ int SigParse(DetectEngineCtx *de_ctx, Signature *s, const char *sigstr, uint8_t
        } while (ret == 1);
    }

-    s->sig_str = NULL;
-


So maybe dup the string based on the value of r.

See previous comment.

inliniac

Minor comment. Looks good otherwise. Can you resubmit an updated branch?

inliniac · 2017-09-19T07:15:25Z

src/output-json-alert.c

+        /* signature text */
+        if (json_output_ctx->flags & LOG_JSON_RULE) {
+            hjs = json_object_get(js, "alert");
+            BUG_ON(!json_is_object(hjs));


this will need a proper check

What's wrong about the check? When the "alert" key is not there it's a bug in the code before, isn't it?

Ah I see now, the "alert" key might not be there in out of memory conditions. I will create an updated PR.

yeah we generally try to allow for alloc issues. Thanks!

Updated PR: #2897

as they are in the protocol cf bug OISF#2881

as they are in the protocol cf bug OISF#2881 (cherry picked from commit 6b30890)

Ticket: OISF#2881

rs-natano mentioned this pull request Aug 23, 2017

eve/alert: include signature text in alert output #2879

Closed

3 tasks

jasonish reviewed Aug 23, 2017

View reviewed changes

inliniac suggested changes Sep 19, 2017

View reviewed changes

inliniac closed this Sep 19, 2017

rs-natano deleted the signature-text-2 branch February 5, 2018 10:44

catenacyber added a commit to catenacyber/suricata that referenced this pull request Nov 25, 2020

doc: http.uri.raw has no spaces

a8e8e06

as they are in the protocol cf bug OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request Nov 30, 2020

doc: http.uri.raw has no spaces

a40be2c

as they are in the protocol cf bug OISF#2881

victorjulien pushed a commit to victorjulien/suricata that referenced this pull request Dec 2, 2020

doc: http.uri.raw has no spaces

6b30890

as they are in the protocol cf bug OISF#2881

victorjulien pushed a commit to victorjulien/suricata that referenced this pull request Dec 2, 2020

doc: http.uri.raw has no spaces

e309492

as they are in the protocol cf bug OISF#2881 (cherry picked from commit 6b30890)

catenacyber added a commit to catenacyber/suricata that referenced this pull request Apr 27, 2022

http: configures libhtp to allow spaces in uri

a788127

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request Apr 28, 2022

http: configures libhtp to allow spaces in uri

e89d507

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request Apr 28, 2022

http: configures libhtp to allow spaces in uri

5a20dc9

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request May 2, 2022

http: configures libhtp to allow spaces in uri

12496c9

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request May 31, 2022

http: configures libhtp to allow spaces in uri

e51da6c

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request Sep 23, 2022

http: configures libhtp to allow spaces in uri

ed8df66

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request Nov 1, 2022

http: configures libhtp to allow spaces in uri

5125858

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request Nov 14, 2022

http: configures libhtp to allow spaces in uri

09fff66

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request Dec 7, 2022

http: configures libhtp to allow spaces in uri

c5b8057

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request Jan 30, 2023

http: configures libhtp to allow spaces in uri

ac01e97

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request Feb 2, 2023

http: configures libhtp to allow spaces in uri

ecf4d84

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request May 18, 2023

http: configures libhtp to allow spaces in uri

4d63d10

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request May 25, 2023

http: configures libhtp to allow spaces in uri

c2cc91c

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request Aug 30, 2023

http: configures libhtp to allow spaces in uri

1f2ed4b

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request Sep 19, 2023

http: configures libhtp to allow spaces in uri

5e95efb

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request Nov 19, 2023

http: configures libhtp to allow spaces in uri

59d35a9

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request Feb 2, 2024

http: configures libhtp to allow spaces in uri

804cbd4

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request Apr 29, 2024

http: configures libhtp to allow spaces in uri

3426b1c

Ticket: OISF#2881

catenacyber added a commit to catenacyber/suricata that referenced this pull request May 4, 2024

http: configures libhtp to allow spaces in uri

99736c4

Ticket: OISF#2881

victorjulien pushed a commit to victorjulien/suricata that referenced this pull request May 16, 2024

http: configures libhtp to allow spaces in uri

7582b18

Ticket: OISF#2881

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

eve/alert: include rule text in alert output #2881

eve/alert: include rule text in alert output #2881

rs-natano commented Aug 23, 2017 •

edited

jasonish Aug 23, 2017

rs-natano Aug 24, 2017

rs-natano Aug 24, 2017

jasonish Aug 24, 2017

jasonish Aug 23, 2017

rs-natano Aug 24, 2017

inliniac left a comment

inliniac Sep 19, 2017

rs-natano Sep 19, 2017

rs-natano Sep 19, 2017

inliniac Sep 19, 2017

rs-natano Sep 19, 2017

eve/alert: include rule text in alert output #2881

eve/alert: include rule text in alert output #2881

Conversation

rs-natano commented Aug 23, 2017 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

inliniac left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rs-natano commented Aug 23, 2017 •

edited