]> git.ipfire.org Git - thirdparty/suricata.git/commit
output/tls: Allow logging of cl-handshake params
authorRichard McConnell <Richard_McConnell@rapid7.com>
Thu, 24 Apr 2025 10:46:47 +0000 (11:46 +0100)
committerVictor Julien <victor@inliniac.net>
Fri, 16 May 2025 19:33:54 +0000 (21:33 +0200)
commit94c8be22d4084ec33b28666649f929f345056da5
tree26fe846b3b465433c3492198da3d6faa7b60a48e
parent912030cbf4cf9b7e0734b7b989b080a15e67282a
output/tls: Allow logging of cl-handshake params

Ticket: 6695

Add new custom log fields:

"client_handshake" which logs the following:
1. TLS version used during handshake
2. TLS extensions, excluding GREASE, SNI and ALPN
3. All cipher suites, excluding GREASE
4. All signature algorithms, excluding GREASE

The use-case is for logging TLS handshake parameters in order to survey
them, and so that JA4 hashes can be computed offline (in the case that
they're not already computed for the purposes of rule matching).
doc/userguide/output/eve/eve-json-format.rst
etc/schema.json
rust/src/handshake.rs
src/output-json-tls.c
suricata.yaml.in