schema: add an object for mapping fields to keywords

To some EVE fields and a "suricata" object that contains an array of
keywords. These are the keywords that map directly to this field, or
somehow cover this field.

This is an attempt at tooling to help with EVE and keyword parity.

Related to tickets: #5642, #6463, #4772

diff --git a/etc/schema.json b/etc/schema.json
index 3a877aabb96ed9e0759934df62d4dfc65858d934..e4dc42a4e87144c5973f862b329469bdfe5a5b6e 100644 (file)
--- a/etc/schema.json
+++ b/etc/schema.json
@@ -116,7 +116,8 @@
             "type": "integer"
         },
         "tx_guessed": {
-            "description": "the signature that triggered this alert didn't tie to a transaction, so the transaction (and metadata) logged is a forced estimation and may not be the one you expect",
+            "description":
+                    "the signature that triggered this alert didn't tie to a transaction, so the transaction (and metadata) logged is a forced estimation and may not be the one you expect",
             "type": "boolean"
         },
         "files": {
@@ -1033,7 +1034,12 @@
                     "type": "boolean"
                 },
                 "rcode": {
-                    "type": "string"
+                    "type": "string",
+                    "suricata": {
+                        "keywords": [
+                            "dns.rcode"
+                        ]
+                    }
                 },
                 "rd": {
                     "type": "boolean"
@@ -1069,10 +1075,21 @@
                         "type": "object",
                         "properties": {
                             "rdata": {
-                                "type": "string"
+                                "type": "string",
+                                "suricata": {
+                                    "keywords": [
+                                        "dns.response.rrname"
+                                    ]
+                                }
                             },
                             "rrname": {
-                                "type": "string"
+                                "type": "string",
+                                "suricata": {
+                                    "keywords": [
+                                        "dns.answers.rrname",
+                                        "dns.response.rrname"
+                                    ]
+                                }
                             },
                             "rrtype": {
                                 "type": "string"
@@ -1173,10 +1190,21 @@
                                 "type": "integer"
                             },
                             "rrname": {
-                                "type": "string"
+                                "type": "string",
+                                "suricata": {
+                                    "keywords": [
+                                        "dns.queries.rrname",
+                                        "dns.query"
+                                    ]
+                                }
                             },
                             "rrtype": {
-                                "type": "string"
+                                "type": "string",
+                                "suricata": {
+                                    "keywords": [
+                                        "dns.rrtype"
+                                    ]
+                                }
                             },
                             "tx_id": {
                                 "type": "integer"
@@ -1189,10 +1217,16 @@
                             },
                             "opcode": {
                                 "description": "DNS opcode as an integer",
-                                "type": "integer"
+                                "type": "integer",
+                                "suricata": {
+                                    "keywords": [
+                                        "dns.opcode"
+                                    ]
+                                }
                             },
                             "rrname_truncated": {
-                                "description": "Set to true if the rrname was too long and truncated by Suricata",
+                                "description":
+                                        "Set to true if the rrname was too long and truncated by Suricata",
                                 "type": "boolean"
                             }
                         },
@@ -6613,7 +6647,8 @@
                     "type": "integer"
                 },
                 "tc_urgent_oob_data": {
-                    "description": "Number of Out-of-Band bytes sent by server using TCP urgent packets",
+                    "description":
+                            "Number of Out-of-Band bytes sent by server using TCP urgent packets",
                     "type": "integer"
                 },
                 "tcp_flags": {
@@ -6632,7 +6667,8 @@
                     "type": "integer"
                 },
                 "ts_urgent_oob_data": {
-                    "description": "Number of Out-of-Band bytes sent by client using TCP urgent packets",
+                    "description":
+                            "Number of Out-of-Band bytes sent by client using TCP urgent packets",
                     "type": "integer"
                 },
                 "urg": {
@@ -6901,7 +6937,8 @@
                     "type": "integer"
                 },
                 "mname_truncated": {
-                    "description": "Set to true if the mname was too long and truncated by Suricata",
+                    "description":
+                            "Set to true if the mname was too long and truncated by Suricata",
                     "type": "boolean"
                 }
             },
@@ -6914,10 +6951,21 @@
                 "type": "object",
                 "properties": {
                     "rdata": {
-                        "type": "string"
+                        "type": "string",
+                        "suricata": {
+                            "keywords": [
+                                "dns.response.rrname"
+                            ]
+                        }
                     },
                     "rrname": {
-                        "type": "string"
+                        "type": "string",
+                        "suricata": {
+                            "keywords": [
+                                "dns.authorities.rrname",
+                                "dns.response.rrname"
+                            ]
+                        }
                     },
                     "rrtype": {
                         "type": "string"
@@ -6929,11 +6977,13 @@
                         "$ref": "#/$defs/dns.soa"
                     },
                     "rdata_truncated": {
-                        "description": "Set to true if the rdata was too long and truncated by Suricata",
+                        "description":
+                                "Set to true if the rdata was too long and truncated by Suricata",
                         "type": "boolean"
                     },
                     "rrname_truncated": {
-                        "description": "Set to true if the rrname was too long and truncated by Suricata",
+                        "description":
+                                "Set to true if the rrname was too long and truncated by Suricata",
                         "type": "boolean"
                     }
                 },
@@ -6947,10 +6997,21 @@
                 "type": "object",
                 "properties": {
                     "rdata": {
-                        "type": "string"
+                        "type": "string",
+                        "suricata": {
+                            "keywords": [
+                                "dns.response.rrname"
+                            ]
+                        }
                     },
                     "rrname": {
-                        "type": "string"
+                        "type": "string",
+                        "suricata": {
+                            "keywords": [
+                                "dns.additionals.rrname",
+                                "dns.response.rrname"
+                            ]
+                        }
                     },
                     "rrtype": {
                         "type": "string"