suricata/yaml no longer has http-headers option
+++ /dev/null
-%YAML 1.1
----
-
-outputs:
- - eve-log:
- enabled: yes
- filetype: regular
- filename: eve.json
- full-logging-for-alerted-flows: printable
-
- types:
- - alert:
- http-headers: yes
- - http:
- extended: yes
- - dns:
- query: yes # enable logging of DNS queries
- answer: yes # enable logging of DNS answers
- - tls:
- extended: yes # enable this for extended logging information
- - files:
- force-magic: no # force logging magic on all logged files
- - smtp:
- - ssh
- - stats:
- totals: yes # stats for all threads merged together
- threads: no # per thread stats
- deltas: no # include delta values
- - flow
- - netflow
- - metadata
+++ /dev/null
-# Silly rule to set the flowbit "traffic/label/cli-http" on
-# the curl user-agent.
-alert http any any -> any any (msg:"TEST"; \
- http.user_agent; content:"curl"; \
- sid:1; rev:1;)
+++ /dev/null
-pcap: ../eve-metadata/testmyids.pcap
-
-requires:
-
- script:
- - grep "http-headers" suricata.yaml.in > /dev/null
-
-checks:
-
- - filter:
- count: 1
- match:
- event_type: alert
- has-key: flow
- has-key: http.response_headers
- has-key: http.request_headers
- - filter:
- count: 1
- match:
- event_type: http
- has-key: http.response_headers
- has-key: http.request_headers