]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
eve/smb: add tx_id to event
authorEric Leblond <el@stamus-networks.com>
Wed, 19 Jan 2022 13:56:06 +0000 (14:56 +0100)
committerVictor Julien <victor@inliniac.net>
Fri, 18 Apr 2025 10:52:21 +0000 (12:52 +0200)
As SMB protocol is using heavily transactions, getting the transaction
ID in SMB events can be really useful for automated analysis.

src/output-json-smb.c

index 528df3d539be3b840d03ebd1e6592241b223c5c4..a2fe47a71bd9312198bd34d023de79d35eab841b 100644 (file)
@@ -64,7 +64,8 @@ static int JsonSMBLogger(ThreadVars *tv, void *thread_data,
 {
     LogSmbLogThread *thread = thread_data;
 
-    SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "smb", NULL, thread->ctx->ctx);
+    SCJsonBuilder *jb =
+            CreateEveHeaderWithTxId(p, LOG_DIR_FLOW, "smb", NULL, tx_id, thread->ctx->ctx);
     if (unlikely(jb == NULL)) {
         return TM_ECODE_FAILED;
     }