<div dir="ltr">Hi Jason,<div><br></div><div>Thank you for the response! A capture file can be downloaded by going to the following link and selecting 'Export -> Download File' (Exporting a new pcapng should work fine):</div><div><br></div><div><a href="https://www.cloudshark.org/captures/cab70e09a7dd/">https://www.cloudshark.org/captures/cab70e09a7dd/</a><br></div><div><br></div><div>I've attached a suricata config and the rule to this e-mail as well. The command I used to generate the eve.json file for this was:</div><div><br></div><div>suricata -c ./no_pcap_cnt_suricata.yaml -S ./no_pcap_cnt.rule -l ./ -r threat_sig_2018856.pcapng</div><div><br></div><div>For me the resulting eve.json file contains:</div><div><br></div><div>$ cat eve.json | jq .</div><div>{</div><div> "timestamp": "2016-12-16T21:33:41.898453-0500",</div><div> "flow_id": 804759363442117,</div><div> "event_type": "alert",</div><div> "src_ip": "65.181.112.240",</div><div> "src_port": 80,</div><div> "dest_ip": "172.16.2.96",</div><div> "dest_port": 49191,</div><div> "proto": "TCP",</div><div> "tx_id": 1,</div><div> "alert": {</div><div> "action": "allowed",</div><div> "gid": 1,</div><div> "signature_id": 2018856,</div><div> "rev": 10,</div><div> "signature": "ET TROJAN Windows executable base64 encoded",</div><div> "category": "A Network Trojan was Detected",</div><div> "severity": 1</div><div> },</div><div> "app_proto": "http",</div><div> "stream": 1</div><div>}</div><div><br></div><div>Is this enough for you to reproduce this? I'm happy to collect any other information for you that I can!</div><div><br></div><div>I'll be looking to see if I can find other rule/pcap combinations that have the same behavior as well.</div><div><br></div><div>Thanks,</div><div>Tom</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Aug 2, 2017 at 4:09 PM, Jason Ish <span dir="ltr"><<a href="mailto:lists@ish.cx" target="_blank">lists@ish.cx</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Tom,<br>
<br>
On 2017-08-02 12:27 PM, Tom Peterson wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi all,<br>
<br>
Thanks for all the hard work on Suricata! I've found it quite easy to build, install, and configure on CentOS which I'm sure took a lot of work and it's just been very user friendly to work with!<br>
<br>
I'm looking at Suricata 4.0.0 and the EVE output that it generates and I'm noticing some differences from Suricata 3.2.0. For example I'm looking at the following rule:<br>
<br>
------------------------------<wbr>----------------<br>
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Windows executable base64 encoded";<br>
flow: established,from_server;<br>
file_data;<br>
content:"TVqQA";<br>
pcre:"/^[A-Za-z0-9]{3}(?:[A-Za<wbr>-z0-9+/]{4}|\s){100}/Rs";<br>
reference:md5,49aca228674651cb<wbr>a776be727bdb7e60;<br>
classtype:trojan-activity;<br>
sid:2018856;<br>
rev:10;<br>
)<br>
------------------------------<wbr>----------------<br>
<br>
In Suricata 4.0.0 I'm noticing that the 'pcap_cnt' and 'payload' values are no longer in the EVE json report.<br>
<br>
My guess is that this has something to do with the 'file_data' keyword in the rule and the new http and metadata logging options in Suricata 4.0.0. I've played with these options a bit but I haven't found a way to get to these two values in the EVE output.<br>
<br>
I'm still investigating this but was wondering if anyone could help me understand this difference.<br>
<br>
I believe the relevant portion of the eve-log config is:<br>
<br>
Suricata 3.2.0:<br>
<br>
------------------------------<wbr>----------------<br>
types:<br>
- alert:<br>
payload: yes # enable dumping payload in Base64<br>
# payload-buffer-size: 4kb # max size of payload buffer to output in eve-log<br>
# payload-printable: yes # enable dumping payload in printable (lossy) format<br>
# packet: yes # enable dumping of packet (without stream segments)<br>
http: no # enable dumping of http fields<br>
tls: no # enable dumping of tls fields<br>
ssh: no # enable dumping of ssh fields<br>
smtp: no # enable dumping of smtp fields<br>
dnp3: no # enable dumping of DNP3 fields<br>
------------------------------<wbr>----------------<br>
<br>
Suricata 4.0.0:<br>
<br>
------------------------------<wbr>----------------<br>
types:<br>
- alert:<br>
payload: yes # enable dumping payload in Base64<br>
# payload-buffer-size: 4kb # max size of payload buffer to output in eve-log<br>
# payload-printable: yes # enable dumping payload in printable (lossy) format<br>
# packet: yes # enable dumping of packet (without stream segments)<br>
http-body: no # enable dumping of http body in Base64<br>
http-body-printable: no # enable dumping of http body in printable format<br>
metadata: no # add L7/applayer fields, flowbit and other vars to the alert<br>
------------------------------<wbr>----------------<br>
<br>
Right now I've generated alerts for all of the malware-traffic-analysis pcaps with the ET Open rules on Suricata 3.2.0 and 4.0.0 and going through all of the differences in the EVE output. If anyone is interested I can share my other findings so far.<br>
</blockquote>
<br>
In all my test cases I have pcap_cnt, and payload. Are you able to bundle up a test case that shows this? Rule, pcap, and probably your suricata.yaml?<br>
<br>
Thanks,<br>
Jason<br>
______________________________<wbr>_________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundati<wbr>on.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/suppor<wbr>t/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfound<wbr>ation.org/mailman/listinfo/<wbr>oisf-users</a><br>
<br>
Conference: <a href="https://suricon.net" rel="noreferrer" target="_blank">https://suricon.net</a><br>
Trainings: <a href="https://suricata-ids.org/training/" rel="noreferrer" target="_blank">https://suricata-ids.org/train<wbr>ing/</a></blockquote></div><br></div>