From c6a3c766853052c641a4f21a0c72b7bb4ce0fd9c Mon Sep 17 00:00:00 2001 From: Philip Akekudaga Date: Fri, 31 Jul 2026 14:41:40 -0400 Subject: [PATCH] schema: map new modbus keywords Map the new modbus per-value keywords to the EVE fields they match. Also add the write.quantity, write.and_mask and write.or_mask properties and allow string data in multiple-write requests, matching what the modbus logger already emits, so that alerts embedding such transactions validate against the schema. Ticket: #8131. --- etc/schema.json | 132 +++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 119 insertions(+), 13 deletions(-) diff --git a/etc/schema.json b/etc/schema.json index 4cff77cefb..63a377c02f 100644 --- a/etc/schema.json +++ b/etc/schema.json @@ -4110,7 +4110,12 @@ "type": "string" }, "raw": { - "type": "integer" + "type": "integer", + "suricata": { + "keywords": [ + "modbus.subfunction" + ] + } } } }, @@ -4121,7 +4126,12 @@ "type": "string" }, "function_raw": { - "type": "integer" + "type": "integer", + "suricata": { + "keywords": [ + "modbus.function" + ] + } }, "mei": { "type": "object", @@ -4139,35 +4149,84 @@ } }, "protocol_id": { - "type": "integer" + "type": "integer", + "suricata": { + "keywords": [ + "modbus.protocol_id" + ] + } }, "read": { "type": "object", "additionalProperties": false, "properties": { "address": { - "type": "integer" + "type": "integer", + "suricata": { + "keywords": [ + "modbus.read.address" + ] + } }, "quantity": { - "type": "integer" + "type": "integer", + "suricata": { + "keywords": [ + "modbus.read.quantity" + ] + } } } }, "transaction_id": { - "type": "integer" + "type": "integer", + "suricata": { + "keywords": [ + "modbus.transaction_id" + ] + } }, "unit_id": { - "type": "integer" + "type": "integer", + "suricata": { + "keywords": [ + "modbus.unit_id" + ] + } }, "write": { "type": "object", "additionalProperties": false, "properties": { "address": { + "type": "integer", + "suricata": { + "keywords": [ + "modbus.write.address" + ] + } + }, + "and_mask": { "type": "integer" }, "data": { + "type": ["string", "number"], + "suricata": { + "keywords": [ + "modbus.write.value" + ] + } + }, + "or_mask": { "type": "integer" + }, + "quantity": { + "type": "integer", + "suricata": { + "keywords": [ + "modbus.write.quantity" + ] + } } } } @@ -4197,7 +4256,12 @@ "type": "string" }, "raw": { - "type": "integer" + "type": "integer", + "suricata": { + "keywords": [ + "modbus.subfunction" + ] + } } } }, @@ -4212,7 +4276,12 @@ "type": "string" }, "raw": { - "type": "integer" + "type": "integer", + "suricata": { + "keywords": [ + "modbus.exception_code" + ] + } } } }, @@ -4220,10 +4289,20 @@ "type": "string" }, "function_raw": { - "type": "integer" + "type": "integer", + "suricata": { + "keywords": [ + "modbus.function" + ] + } }, "protocol_id": { - "type": "integer" + "type": "integer", + "suricata": { + "keywords": [ + "modbus.protocol_id" + ] + } }, "read": { "type": "object", @@ -4235,19 +4314,46 @@ } }, "transaction_id": { - "type": "integer" + "type": "integer", + "suricata": { + "keywords": [ + "modbus.transaction_id" + ] + } }, "unit_id": { - "type": "integer" + "type": "integer", + "suricata": { + "keywords": [ + "modbus.unit_id" + ] + } }, "write": { "type": "object", "additionalProperties": false, "properties": { "address": { + "type": "integer", + "suricata": { + "keywords": [ + "modbus.write.address" + ] + } + }, + "and_mask": { "type": "integer" }, "data": { + "type": "integer", + "suricata": { + "keywords": [ + "modbus.write.value", + "modbus.write.quantity" + ] + } + }, + "or_mask": { "type": "integer" } }