[Oisf-users] Setting up a rule to capture all Javascript files traversing the network

[Dave Florek]

Thanks. I'll try that route.

On Thu, Aug 11, 2016 at 4:23 PM, Peter Manev <petermanev at gmail.com> wrote:

>
>
> On 11 Aug 2016, at 21:12, Dave Florek <dave.a.florek at gmail.com> wrote:
>
> Thanks Peter.
>
> How can I find a list of all the libmagic types to pick out what's
> Javascript matching?
>
>
> The most accurate will be on the system the Suricata runs - copy over or
> find a JavaScript file and try -
>
> file somejavascriptfile.js
>
> That should return the filemagic info you are after.
>
>
>
> On Thu, Aug 11, 2016 at 2:50 PM, Peter Manev <petermanev at gmail.com> wrote:
>
>>
>>
>> > --
>> > Regards,
>> > Peter Manev
>> > On 11 Aug 2016, at 17:12, Dave Florek <dave.a.florek at gmail.com> wrote:
>> >
>> > Hi,
>> >
>> > I'm trying to setup a rule to capture all Javascript (.js) files that
>> are traversing my network. Here is the rule I created to do it. The problem
>> is that it's giving me more files that are outside the .js extension and
>> I'm wondering if the filemagic command has a property for javascript files
>> or if there is a better way to construct the rule to capture only .js
>> extension types.
>> >
>> >
>> > alert http any any -> any any (msg:"FILEXT js";
>> flow:established,to_server;filestore; sid:9; rev:1;)
>>
>>
>> The rule above will try to store every single file it sees to disk.
>>
>> You should employ some additional file keywords (filemagic) in order to
>> get just Java scripts. Some more info can be found here -
>> https://redmine.openinfosecfoundation.org/projects/suricata/
>> wiki/File-keywords
>>
>>
>> >
>> > Thanks in advance,
>> >
>> > _______________________________________________
>> > Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
>> > Site: http://suricata-ids.org | Support: http://suricata-ids.org/suppor
>> t/
>> > List: https://lists.openinfosecfoundation.org/mailman/listinfo/
>> oisf-users
>> > Suricata User Conference November 9-11 in Washington, DC:
>> http://oisfevents.net
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20160811/8326ae98/attachment-0002.html>