]> git.ipfire.org Git - thirdparty/suricata.git/commit
output/ja4: Log ja4 hashes iff configured 11276/head 11288/head
authorJeff Lucovsky <jlucovsky@oisf.net>
Wed, 5 Jun 2024 13:06:39 +0000 (09:06 -0400)
committerJeff Lucovsky <jlucovsky@oisf.net>
Sat, 8 Jun 2024 14:00:58 +0000 (10:00 -0400)
commitffca7658a2ad2b21cdc83fb6432e4b7c77f67843
tree5d710b73df4e762b119d2c56d6e9c18dd02406dd
parent1f5e10a49c41a2e331920a470a0a41c925e6f1d4
output/ja4: Log ja4 hashes iff configured

This commit allows ja4 hashes to be logged iff enabled in the tls/quic
section of the outputs.

With the default setting ("off"), ja4 hashes will only be logged in
alerts when the signatures uses the ja4.hash keyword.

When enabled, ja4 hashes will be inclued in quic and tls logs.

- tls:
     ja4: on
- quic:
     ja4: on

Issue: 7010
doc/userguide/partials/eve-log.yaml
doc/userguide/upgrade.rst
src/output-json-quic.c
src/output-json-tls.c
src/output-json-tls.h
suricata.yaml.in