[Oisf-users] http.log + rules meta information

[Peter Manev]

On Sat, Jan 11, 2014 at 5:28 PM, Nikita Kislitsin <kislitsin at group-ib.ru> wrote:
> Hello there!
>
> I'm new to Suricata, and it seems a great system! Would really appeciate any
> help with my small question.
>
> Is there any way to include rules meta-information (msg field) to http.log
> records? I need not only have details about http request/responce, but also
> include a reference to the specific rule based on which this event was
> recored. Is it possible to combine in one log file this information?

Is correlation what you are after ?

>
> For now I only see the solution in syncronising two separate log files -
> fast.log (with event/rule details) and http.log (with details of http
> requests). Would be great to come up with something better.
>
> Thanks,
> Nikita
>
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> OISF: http://www.openinfosecfoundation.org/



-- 
Regards,
Peter Manev