<div dir="ltr">Thanks!<br><br><div>I need to search in http requests and write a log that includes all the details about matching sessions - src/dst ip:port, matched rule msg, domain, URI and method of HTTP-request.</div><div>
<br></div><div>Looks like Suricata can't do that from the box, right?</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">2014/1/11 Chris Edwards <span dir="ltr"><<a href="mailto:Chris.Edwards@glasgow.ac.uk" target="_blank">Chris.Edwards@glasgow.ac.uk</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Sat, 11 Jan 2014, Nikita Kislitsin wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Is there any way to include rules meta-information (*msg *field) to<div class="im"><br>
http.log records? I need not only have details about http request/responce,<br>
but also include a reference to the specific rule based on which this event<br>
was recored.<br>
</div></blockquote>
<br>
http.log is somewhat different in that it contains entries for *all* http transactions on the network, irrespective of whether they triggered an rule hit.<br>
<br>
Of course, some http.log entries do relate to rule hits, so it might be nice to have some sort of reference as you suggest. But what if multiple rules were triggered by a single request ? Perhaps it would be better to record the URL info as part of fast.log. Either way, I don't think this is possible at present. That said, where packet data is captured with rule hits, if you view the packet in wireshark etc, then the URL is there for you.<span class="HOEnZb"><font color="#888888"><br>
<br>
Chris<br>
<br>
-- <br>
Chris Edwards, Information Security, IT Services<br>
University of Glasgow, charity number SC004401</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
______________________________<u></u>_________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@<u></u>openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/<u></u>support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.<u></u>openinfosecfoundation.org/<u></u>mailman/listinfo/oisf-users</a><br>
OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.<u></u>openinfosecfoundation.org/</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><div style="font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><table style="font-size:medium;font-family:Times">
<tbody><tr><td style="text-align:center;padding-right:10px;width:160px"><img src="http://www.group-ib.ru/i/gib_logo.png" width="143" height="59" alt="Group-IB"><br><font style="font-weight:bold;font-size:10px;font-family:sans-serif;line-height:24px">Global Cyber Security Company</font><br>
<a href="http://www.facebook.com/GroupIB" style="color:rgb(17,85,204)" target="_blank"><img src="http://www.group-ib.ru/i/facebook.png" width="34" height="34"></a> <a href="http://twitter.com/groupib" style="color:rgb(17,85,204)" target="_blank"><img src="http://www.group-ib.ru/i/twitter.png" width="34" height="34"></a> <a href="http://www.linkedin.com/groups/GroupIB-Cybercrime-Cyberterrorism-4390171" style="color:rgb(17,85,204)" target="_blank"><img src="http://www.group-ib.ru/i/linkedin.png" width="34" height="34"></a> <a href="http://www.youtube.com/user/GroupIB" style="color:rgb(17,85,204)" target="_blank"><img src="http://www.group-ib.ru/i/youtube.png" width="34" height="34"></a></td>
<td><font color="#000000" style="font-family:sans-serif;font-size:12px"><span style="font-size:16px;font-weight:bold;font-family:arial,sans-serif">Nikita Kislitsin</span><br></font><div style="font-family:sans-serif;font-size:12px">
<span style="color:rgb(0,0,0)">Head of Botnet Monitoring Project</span><font color="#000000"><br></font></div><font style="font-family:sans-serif;font-size:12px;font-weight:bold" color="#000000">Group-IB</font><br><font face="sans-serif"><span style="font-size:12.222222328186035px">+7 (495) </span><span style="font-size:12px">984-33-64</span><span style="font-size:12.222222328186035px"> ext. 137</span></font><br>
<font face="sans-serif"><span style="font-size:12px"><u></u>+7 (903) 791-65-28<u></u></span></font><br><a href="mailto:kislitsin@group-ib.com" style="font-family:sans-serif;font-size:12px;color:rgb(17,85,204)" target="_blank">kislitsin@group-ib.com</a><br>
<a href="http://www.group-ib.com/" style="font-family:sans-serif;font-size:12px;color:rgb(17,85,204)" target="_blank">www.group-ib.com</a><font face="sans-serif"><span style="font-size:12px"> </span></font></td></tr></tbody></table>
</div><div style="font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br></div><span style="font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><font><div></div></font></span></div>
</div>