inliniac/suricata — pull request #922 by MattCarothers (2014-04-08 18:23:14+00:00)
Title: Json alert packet payload feature 1155 v2

This patch adds "packet" and "payload" fields to JSON alert output.

"packet" is the base64-encoded packet that generated the alert. Note that due to the way suricata stores packet data in memory, the payload will be missing from the "packet" field when the alert is on stream data. Suricata provides a method to iterate over stream payloads but not full packets. It doesn't appear that the headers are stored for every packet in a stream, so I couldn't find a way to make this output a list in that case.

"payload" is the printable strings from either the packet or the stream if the alert was on a stream. Stream payloads are concatenated into the field rather than creating a list for consistency in parsing. If the payload comes from a stream, an additional JSON parameter named "stream" is set to 1. This lets a parser know that the "packet" field will be truncated and that the payload field may be as well. I arbitrarily picked 4096 as the buffer size for stream payloads. It would be more elegant to make it a configurable parameter, but the file_ctx object only has a "flags" parameter and no way to pass in an integer value without more modification.

Packet and payload logging is controlled via new configuration parameters:

outputs:
- eve-log:
enabled: yes
type: file
filename: eve.json
types:
- alert:
payload: yes # enable this to include printable strings from packet payloads in alerts
packet: yes # enable this to include base64-encoded packets in alerts