aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

userguide: update tls not_after/not_before mentions

Browse Source 
Our tls fields not_after and not_before are actually logged as
`notafter` and `notbefore`, but were documented with the underscore.

Update the documentation, since updating the log format itself would be
a breaking change.

Task #5494
pull/9829/head
Juliana Fajardini 2 years ago committed by Victor Julien
parent 58fb559594
commit a649a92afd
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File

4
doc/userguide/output/eve/eve-json-format.rst
Unescape Escape View File

@ -1041,8 +1041,8 @@ If extended logging is enabled the following fields are also included:
* "fingerprint": The (SHA1) fingerprint of the TLS certificate
* "sni": The Server Name Indication (SNI) extension sent by the client
* "version": The SSL/TLS version used
* "not_before": The NotBefore field from the TLS certificate
* "not_after": The NotAfter field from the TLS certificate
* "notbefore": The NotBefore field from the TLS certificate
* "notafter": The NotAfter field from the TLS certificate
* "ja3": The JA3 fingerprint consisting of both a JA3 hash and a JA3 string
* "ja3s": The JA3S fingerprint consisting of both a JA3 hash and a JA3 string

Write Preview
Loading…
Cancel
Save