suricata
output-json-alert.c File Reference
#include "suricata-common.h"
#include "debug.h"
#include "detect.h"
#include "flow.h"
#include "conf.h"
#include "threads.h"
#include "tm-threads.h"
#include "threadvars.h"
#include "util-debug.h"
#include "util-misc.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-reference.h"
#include "detect-metadata.h"
#include "app-layer-parser.h"
#include "app-layer-dnp3.h"
#include "app-layer-dns-common.h"
#include "app-layer-htp.h"
#include "app-layer-htp-xff.h"
#include "app-layer-ftp.h"
#include "util-classification-config.h"
#include "util-syslog.h"
#include "util-logopenfile.h"
#include "output.h"
#include "output-json.h"
#include "output-json-alert.h"
#include "output-json-dnp3.h"
#include "output-json-dns.h"
#include "output-json-http.h"
#include "output-json-tls.h"
#include "output-json-ssh.h"
#include "output-json-smtp.h"
#include "output-json-email-common.h"
#include "output-json-nfs.h"
#include "output-json-smb.h"
#include "output-json-flow.h"
#include "output-json-sip.h"
#include "util-byte.h"
#include "util-privs.h"
#include "util-print.h"
#include "util-proto-name.h"
#include "util-optimize.h"
#include "util-buffer.h"
#include "util-crypt.h"
#include "util-validate.h"
Include dependency graph for output-json-alert.c:

Go to the source code of this file.

Data Structures

struct  AlertJsonOutputCtx_
 
struct  JsonAlertLogThread_
 

Macros

#define MODULE_NAME   "JsonAlertLog"
 
#define LOG_JSON_PAYLOAD   BIT_U16(0)
 
#define LOG_JSON_PACKET   BIT_U16(1)
 
#define LOG_JSON_PAYLOAD_BASE64   BIT_U16(2)
 
#define LOG_JSON_TAGGED_PACKETS   BIT_U16(3)
 
#define LOG_JSON_APP_LAYER   BIT_U16(4)
 
#define LOG_JSON_FLOW   BIT_U16(5)
 
#define LOG_JSON_HTTP_BODY   BIT_U16(6)
 
#define LOG_JSON_HTTP_BODY_BASE64   BIT_U16(7)
 
#define LOG_JSON_RULE_METADATA   BIT_U16(8)
 
#define LOG_JSON_RULE   BIT_U16(9)
 
#define METADATA_DEFAULTS
 
#define JSON_BODY_LOGGING   (LOG_JSON_HTTP_BODY | LOG_JSON_HTTP_BODY_BASE64)
 
#define JSON_STREAM_BUFFER_SIZE   4096
 
#define DEFAULT_LOG_FILENAME   "alert.json"
 

Typedefs

typedef struct AlertJsonOutputCtx_ AlertJsonOutputCtx
 
typedef struct JsonAlertLogThread_ JsonAlertLogThread
 

Functions

void AlertJsonHeader (void *ctx, const Packet *p, const PacketAlert *pa, json_t *js, uint16_t flags)
 
void JsonAlertLogRegister (void)
 

Detailed Description

Author
Tom DeCanio td@np.nosp@m.ulse.nosp@m.tech..nosp@m.com

Logs alerts in JSON format.

Definition in file output-json-alert.c.

Macro Definition Documentation

#define DEFAULT_LOG_FILENAME   "alert.json"

Definition at line 800 of file output-json-alert.c.

#define JSON_BODY_LOGGING   (LOG_JSON_HTTP_BODY | LOG_JSON_HTTP_BODY_BASE64)

Definition at line 98 of file output-json-alert.c.

#define JSON_STREAM_BUFFER_SIZE   4096

Definition at line 100 of file output-json-alert.c.

#define LOG_JSON_APP_LAYER   BIT_U16(4)

Definition at line 87 of file output-json-alert.c.

Referenced by AlertJsonHeader().

#define LOG_JSON_FLOW   BIT_U16(5)

Definition at line 88 of file output-json-alert.c.

Referenced by AlertJsonHeader().

#define LOG_JSON_HTTP_BODY   BIT_U16(6)

Definition at line 89 of file output-json-alert.c.

Referenced by AlertJsonHeader().

#define LOG_JSON_HTTP_BODY_BASE64   BIT_U16(7)

Definition at line 90 of file output-json-alert.c.

Referenced by AlertJsonHeader().

#define LOG_JSON_PACKET   BIT_U16(1)

Definition at line 84 of file output-json-alert.c.

Referenced by AlertJsonHeader().

#define LOG_JSON_PAYLOAD   BIT_U16(0)

Definition at line 83 of file output-json-alert.c.

Referenced by AlertJsonHeader().

#define LOG_JSON_PAYLOAD_BASE64   BIT_U16(2)

Definition at line 85 of file output-json-alert.c.

Referenced by AlertJsonHeader().

#define LOG_JSON_RULE   BIT_U16(9)

Definition at line 92 of file output-json-alert.c.

Referenced by AlertJsonHeader().

#define LOG_JSON_RULE_METADATA   BIT_U16(8)

Definition at line 91 of file output-json-alert.c.

Referenced by AlertJsonHeader().

#define LOG_JSON_TAGGED_PACKETS   BIT_U16(3)

Definition at line 86 of file output-json-alert.c.

Referenced by AlertJsonHeader().

#define METADATA_DEFAULTS
Value:
#define LOG_JSON_FLOW
#define LOG_JSON_RULE_METADATA
#define LOG_JSON_APP_LAYER

Definition at line 94 of file output-json-alert.c.

#define MODULE_NAME   "JsonAlertLog"

Definition at line 81 of file output-json-alert.c.

Referenced by JsonAlertLogRegister().

Typedef Documentation

Function Documentation

void AlertJsonHeader ( void *  ctx,
const Packet p,
const PacketAlert pa,
json_t *  js,
uint16_t  flags 
)

Definition at line 295 of file output-json-alert.c.

References PacketAlert_::action, ACTION_DROP, ACTION_REJECT, ACTION_REJECT_BOTH, ACTION_REJECT_DST, AlertJsonHeader(), PacketAlerts_::alerts, Packet_::alerts, Flow_::alproto, ALPROTO_DNP3, ALPROTO_DNS, ALPROTO_FTPDATA, ALPROTO_HTTP, ALPROTO_NFS, ALPROTO_SIP, ALPROTO_SMB, ALPROTO_SMTP, ALPROTO_SSH, ALPROTO_TLS, AppProtoToString(), Base64Encode(), MemBuffer_::buffer, AlertJsonOutputCtx_::cfg, Signature_::class_msg, PacketAlerts_::cnt, ConfNodeLookupChildValue(), ConfValIsTrue(), CreateIsoTimeString(), CreateJSONHeader(), OutputCtx_::data, DEBUG_VALIDATE_BUG_ON, EngineModeIsIPS(), FALSE, AlertJsonOutputCtx_::file_ctx, JsonAlertLogThread_::file_ctx, HttpXFFCfg_::flags, AlertJsonOutputCtx_::flags, PacketAlert_::flags, Packet_::flags, Signature_::flags, Packet_::flow, FLOW_PKT_TOCLIENT, FLOW_PKT_TOSERVER, Packet_::flowflags, FlowGetAppProtocol(), Signature_::gid, HttpXFFGetIP(), HttpXFFGetIPFromTx(), Signature_::id, IS_TUNNEL_PKT, JsonAlertLogThread_::json_buffer, JSON_OUTPUT_BUFFER_SIZE, JsonAlertLogThread_::json_output_ctx, JsonAddCommonOptions(), JsonAddFlow(), JsonEmailAddMetadata(), JsonFiveTuple(), JsonFTPDataAddMetadata(), JsonHttpAddMetadata(), JsonHttpLogJSONBodyBase64(), JsonHttpLogJSONBodyPrintable(), JsonNFSAddMetadata(), JsonNFSAddMetadataRPC(), JsonPacket(), JsonSIPAddMetadata(), JsonSMBAddMetadata(), JsonSMTPAddMetadata(), len, LOG_DIR_PACKET, LOG_JSON_APP_LAYER, LOG_JSON_FLOW, LOG_JSON_HTTP_BODY, LOG_JSON_HTTP_BODY_BASE64, LOG_JSON_PACKET, LOG_JSON_PAYLOAD, LOG_JSON_PAYLOAD_BASE64, LOG_JSON_RULE, LOG_JSON_RULE_METADATA, LOG_JSON_TAGGED_PACKETS, LogFileFreeCtx(), m, MemBufferCreateNew(), MemBufferFree(), MemBufferReset, Signature_::msg, MemBuffer_::offset, offset, OutputJSONBuffer(), PACKET_ALERT_FLAG_STATE_MATCH, PACKET_ALERT_FLAG_STREAM_MATCH, PACKET_ALERT_FLAG_TX, PACKET_ALERT_RATE_FILTER_MODIFIED, PACKET_TEST_ACTION, AlertJsonOutputCtx_::parent_xff_cfg, Packet_::payload, JsonAlertLogThread_::payload_buffer, AlertJsonOutputCtx_::payload_buffer_size, Packet_::payload_len, PKT_HAS_TAG, PKT_IS_IPV4, PKT_IS_IPV6, PrintStringsToBuffer(), Signature_::prio, proto, Packet_::proto, Packet_::recursion_level, Signature_::rev, Packet_::root, PacketAlert_::s, SC_BASE64_OK, SCFree, SCJsonString(), SCLogDebug, SCMalloc, SCMutex, SCMutexLock, SCMutexUnlock, SIG_FLAG_HAS_TARGET, Signature_::sig_str, StreamSegmentForEach(), Packet_::tenant_id, TM_ECODE_FAILED, TM_ECODE_OK, TRUE, Packet_::ts, Packet_::tunnel_mutex, PacketAlert_::tx_id, unlikely, AlertJsonOutputCtx_::xff_cfg, XFF_DISABLED, XFF_EXTRADATA, XFF_MAXLEN, and XFF_OVERWRITE.

Referenced by AlertJsonHeader().

Here is the call graph for this function:

Here is the caller graph for this function:

void JsonAlertLogRegister ( void  )

Definition at line 990 of file output-json-alert.c.

References LOGGER_JSON_ALERT, MODULE_NAME, OutputRegisterPacketModule(), and OutputRegisterPacketSubModule().

Referenced by OutputRegisterLoggers().

Here is the call graph for this function:

Here is the caller graph for this function: