From db110783151ee253772fbcec1a07d88ee3a8ab8c Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Wed, 19 Jan 2022 14:56:06 +0100 Subject: [PATCH] eve/smb: add tx_id to event As SMB protocol is using heavily transactions, getting the transaction ID in SMB events can be really useful for automated analysis. --- src/output-json-smb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/output-json-smb.c b/src/output-json-smb.c index 528df3d539..a2fe47a71b 100644 --- a/src/output-json-smb.c +++ b/src/output-json-smb.c @@ -64,7 +64,8 @@ static int JsonSMBLogger(ThreadVars *tv, void *thread_data, { LogSmbLogThread *thread = thread_data; - SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "smb", NULL, thread->ctx->ctx); + SCJsonBuilder *jb = + CreateEveHeaderWithTxId(p, LOG_DIR_FLOW, "smb", NULL, tx_id, thread->ctx->ctx); if (unlikely(jb == NULL)) { return TM_ECODE_FAILED; } -- 2.47.2