output/eve: add 'verdict' field to 'alert' and 'drop' events - v1 #8318
Conversation
The eve logs have a field alert.action that will say something like 'allowed' even if a packet gets blocked by some other rule. To make this less ambiguous, added a field to the alert and drop events indicating the final verdict by the engine for a given packet. Bug OISF#5464
The `fiel action` portion seemed to be comprised of a more generic section that followed it. Also formatted the section for lines to be within the character limit.
| const char *verdict = PacketActionVerdictToString(p); | ||
| jb_set_string(js, "verdict", verdict); | ||
|
|
There was a problem hiding this comment.
This felt a bit redundant when I was documenting it...
Codecov Report
Additional details and impacted files@@ Coverage Diff @@
## master #8318 +/- ##
==========================================
- Coverage 81.89% 81.88% -0.01%
==========================================
Files 963 963
Lines 277295 277307 +12
==========================================
- Hits 227082 227074 -8
- Misses 50213 50233 +20
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
Information:
Pipeline 11285 |
| @@ -168,6 +168,9 @@ outputs: | |||
| # Enable the logging of tagged packets for rules using the | |||
| # "tag" keyword. | |||
| tagged-packets: yes | |||
| # Enable logging the final verdict on a packet (e.g. "blocked", | |||
There was a problem hiding this comment.
these don't match the actual logged values
There was a problem hiding this comment.
shame on me >____<'
| @@ -168,6 +168,9 @@ outputs: | |||
| # Enable the logging of tagged packets for rules using the | |||
| # "tag" keyword. | |||
| tagged-packets: yes | |||
| # Enable logging the final verdict on a packet (e.g. "blocked", | |||
| # "allowed", "rejected") | |||
| verdict: yes | |||
There was a problem hiding this comment.
wonder if we should make the action field optional instead. That is the confusing one.
There was a problem hiding this comment.
Then verdict becomes mandatory, and action optional?
There was a problem hiding this comment.
Making action optional becomes a bit annoying for the drop events, with our current way of handling optional fields in the alerts (the context flags). Should we keep this field mandatory, there?
|
More work to do on this. On it... |
|
Replaced by: #8347 |
Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/5464
Describe changes:
verdictfielddropevent type for eve output