From cc519beb910c87dc8a6059f256a1ec18389f050a Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Fri, 18 Oct 2024 09:11:22 -0600 Subject: [PATCH] suricata.yaml: add missing custom tls fields Also update the suricata.yaml in the userguide. --- doc/userguide/partials/eve-log.yaml | 3 ++- suricata.yaml.in | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/doc/userguide/partials/eve-log.yaml b/doc/userguide/partials/eve-log.yaml index 12362fe84b..05faf209d4 100644 --- a/doc/userguide/partials/eve-log.yaml +++ b/doc/userguide/partials/eve-log.yaml @@ -181,7 +181,8 @@ outputs: # session id #session-resumption: no # custom controls which TLS fields that are included in eve-log - #custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, chain, ja3, ja3s, ja4] + # WARNING: enabling custom disables extended logging. + #custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, chain, ja3, ja3s, ja4, subjectaltname, client, client_certificate, client_chain, client_alpns, server_alpns] - files: force-magic: no # force logging magic on all logged files # force logging of checksums, available hash functions are md5, diff --git a/suricata.yaml.in b/suricata.yaml.in index f191bf60b9..7bf4165c36 100644 --- a/suricata.yaml.in +++ b/suricata.yaml.in @@ -273,7 +273,7 @@ outputs: #session-resumption: no # custom controls which TLS fields that are included in eve-log # WARNING: enabling custom disables extended logging. - #custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, chain, ja3, ja3s, ja4, subjectaltname] + #custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, chain, ja3, ja3s, ja4, subjectaltname, client, client_certificate, client_chain, client_alpns, server_alpns] - files: force-magic: no # force logging magic on all logged files # force logging of checksums, available hash functions are md5,