diff --git a/doc/userguide/output/eve/eve-json-format.rst b/doc/userguide/output/eve/eve-json-format.rst index 99f1b3f3a9..b5a2bf4641 100644 --- a/doc/userguide/output/eve/eve-json-format.rst +++ b/doc/userguide/output/eve/eve-json-format.rst @@ -2526,7 +2526,7 @@ Requests are sent by the frontend (client), which would be the source of a pgsql flow. Some of the possible request messages are: * "startup_message": message sent to start a new PostgreSQL connection -* "password_message": if password output for PGSQL is enabled in suricata.yaml, +* "password": if password output for PGSQL is enabled in suricata.yaml, carries the password sent during Authentication phase * "password_redacted": set to true in case there is a password message, but its logging is disabled diff --git a/etc/schema.json b/etc/schema.json index 58252008f3..791186da64 100644 --- a/etc/schema.json +++ b/etc/schema.json @@ -3660,9 +3660,6 @@ "password": { "type": "string" }, - "password_message": { - "type": "string" - }, "password_redacted": { "type": "boolean", "description": "indicates if a password message was received but not logged due to Suricata settings" diff --git a/rust/src/pgsql/logger.rs b/rust/src/pgsql/logger.rs index 7bb5b4d8b3..fab077edfd 100644 --- a/rust/src/pgsql/logger.rs +++ b/rust/src/pgsql/logger.rs @@ -80,7 +80,7 @@ fn log_request(req: &PgsqlFEMessage, flags: u32) -> Result { if flags & PGSQL_LOG_PASSWORDS != 0 { - js.set_string_from_bytes("password", payload)?; + js.set_string_from_bytes(req.to_str(), payload)?; } else { js.set_bool("password_redacted", true)?; } diff --git a/rust/src/pgsql/parser.rs b/rust/src/pgsql/parser.rs index 2bddbb1138..b031be332b 100644 --- a/rust/src/pgsql/parser.rs +++ b/rust/src/pgsql/parser.rs @@ -393,7 +393,7 @@ impl PgsqlFEMessage { match self { PgsqlFEMessage::StartupMessage(_) => "startup_message", PgsqlFEMessage::SSLRequest(_) => "ssl_request", - PgsqlFEMessage::PasswordMessage(_) => "password_message", + PgsqlFEMessage::PasswordMessage(_) => "password", PgsqlFEMessage::SASLInitialResponse(_) => "sasl_initial_response", PgsqlFEMessage::SASLResponse(_) => "sasl_response", PgsqlFEMessage::SimpleQuery(_) => "simple_query",