From cc6fbcd5dd08c3b187c942fbd399e7348460e461 Mon Sep 17 00:00:00 2001
From: Jeff Lucovsky <jlucovsky@oisf.net>
Date: Sun, 17 May 2026 08:31:37 -0400
Subject: [PATCH] etc/schema: add missing ftp fields

Add ftp detect keywords to metadata

Issue: 7502, 7503, 7507, 7505, 7508, 7506
---
 etc/schema.json | 58 ++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 50 insertions(+), 8 deletions(-)

diff --git a/etc/schema.json b/etc/schema.json
index 19af7cc38b..e73d99bec9 100644
--- a/etc/schema.json
+++ b/etc/schema.json
@@ -2192,19 +2192,35 @@
             "additionalProperties": false,
             "properties": {
                 "command": {
-                    "type": "string"
+                    "type": "string",
+                    "suricata": {
+                        "keywords": [
+                            "ftp.command"
+                        ]
+                    }
                 },
                 "command_data": {
-                    "type": "string"
+                    "type": "string",
+                    "suricata": {
+                        "keywords": [
+                            "ftp.command_data"
+                        ]
+                    }
                 },
                 "command_truncated": {
-                    "type": "boolean"
+                    "type": "boolean",
+                    "$comment": "keyword: app-layer-event:ftp.request_command_too_long"
                 },
                 "completion_code": {
                     "type": "array",
                     "minItems": 1,
                     "items": {
                         "type": "string"
+                    },
+                    "suricata": {
+                        "keywords": [
+                            "ftp.completion_code"
+                        ]
                     }
                 },
                 "dynamic_port": {
@@ -2216,20 +2232,36 @@
                     }
                 },
                 "mode": {
-                    "type": "string"
+                    "type": "string",
+                    "suricata": {
+                        "keywords": [
+                            "ftp.mode"
+                        ]
+                    }
                 },
                 "reply": {
                     "type": "array",
                     "minItems": 1,
                     "items": {
                         "type": "string"
+                    },
+                    "suricata": {
+                        "keywords": [
+                            "ftp.reply"
+                        ]
                     }
                 },
                 "reply_received": {
-                    "type": "string"
+                    "type": "string",
+                    "suricata": {
+                        "keywords": [
+                            "ftp.reply_received"
+                        ]
+                    }
                 },
                 "reply_truncated": {
-                    "type": "boolean"
+                    "type": "boolean",
+                    "$comment": "keyword: app-layer-event:ftp.response_command_too_long"
                 }
             }
         },
@@ -2238,10 +2270,20 @@
             "additionalProperties": false,
             "properties": {
                 "command": {
-                    "type": "string"
+                    "type": "string",
+                    "suricata": {
+                        "keywords": [
+                            "ftpdata_command"
+                        ]
+                    }
                 },
                 "filename": {
-                    "type": "string"
+                    "type": "string",
+                    "suricata": {
+                        "keywords": [
+                            "file.name"
+                        ]
+                    }
                 }
             }
         },