Can you get the source IP and the HTTP URI at the same time in Lua?

Help
1

Is there a way to get a lua script that has access both to the srcip of a packet and http information like the uri?

2

I think so. You can get the HTTP information by e.g. requiring needs, e.g.

needs["http.uri"] = tostring(true)

(see 6.36. Lua Scripting — Suricata 7.0.0-dev documentation)

and the IPs via the flow or packet tuple:

ipver, srcip, dstip, proto, sp, dp = SCFlowTuple()

(see 16.2. Lua functions — Suricata 7.0.0-dev documentation)

Example:

function init (args)
    local needs = {}
    needs["http.uri"] = tostring(true)
    return needs
end

function match(args)
    ipver, srcip, dstip, proto, sp, dp = SCFlowTuple()
    SCLogNotice(srcip .. "  " .. args["http.uri"])
    return 0
end
1 Like