From 6f06f7c22cc85f760c5e6442695266fdbe5a372e Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Sun, 14 Feb 2021 19:14:30 +0100 Subject: [PATCH] doc: add info about capture_file key --- doc/userguide/configuration/suricata-yaml.rst | 4 ++-- doc/userguide/output/eve/eve-json-format.rst | 7 +++++++ 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/doc/userguide/configuration/suricata-yaml.rst b/doc/userguide/configuration/suricata-yaml.rst index 7b675df346..3c8b78afa9 100644 --- a/doc/userguide/configuration/suricata-yaml.rst +++ b/doc/userguide/configuration/suricata-yaml.rst @@ -473,9 +473,9 @@ By default all packets are logged except: It is possible to do conditional pcap logging by using the `conditional` option in the pcap-log section. By default the variable is set to `all` -so all packet are logged. If the variable is set to `alerts` then only +so all packets are logged. If the variable is set to `alerts` then only the flow with alerts will be logged. If the variable is set to `tag` -then only packets tagged by signature using the `tag` keyword will +then only packets tagged by signatures using the `tag` keyword will be logged to the pcap file. Please note that if `alerts` or `tag` is used, then in the case of TCP session, Suricata will use available information from the streaming engine to log data that have triggered diff --git a/doc/userguide/output/eve/eve-json-format.rst b/doc/userguide/output/eve/eve-json-format.rst index 3b4ac5b576..d68f9cf4aa 100644 --- a/doc/userguide/output/eve/eve-json-format.rst +++ b/doc/userguide/output/eve/eve-json-format.rst @@ -147,6 +147,13 @@ the signature. } }, +Pcap Field +~~~~~~~~~~ + +If pcap log capture is active in `multi` mode, a `capture_file` key will be added to the event +with value being the full path of the pcap file where the corresponding packets +have been extracted. + Event type: Anomaly -------------------