suricata icon indicating copy to clipboard operation
suricata copied to clipboard

output/reference: Include reference information in alert (if configured)

Open jlucovsky opened this issue 1 month ago • 4 comments

Continuation of #11079

When configured, include the reference value in the alert. The configuration value is in the alert section: types.alert.reference. The default value is off/no. Set to yes to include the expanded reference from the rule in the alert record.

Link to redmine ticket: 4974

Describe changes:

  • Add reference value to suricata.yaml.in (default no/off)
  • Set flag in output logger if the config setting is on
  • Format the reference as a sequence, e.g., references: [ "ref-1" [, "ref-2" [, ...]]]

Updates:

  • Rebase (and s-v rebase)

Provide values to any of the below to override the defaults.

SV_BRANCH=https://github.com/OISF/suricata-verify/pull/1808

jlucovsky avatar May 16 '24 12:05 jlucovsky