I’ve been working on a forensic mode for Suricata. This is a set of options that can be used to analyze data (mostly pcap files as it is really verbose) and get as much data as possible. The first one adds an option to log all HTTP headers in alert. As the alert is sometime on specific headers valu…

Forensic mode for full logging

Jeff_Lucovsky (Jeff Lucovsky) May 26, 2020, 11:59am 3

There are runtime configuration options for forensic mode (see doc/userguide/output/eve/eve-json-format.rst) but no configure options.

How to record http access response body in Suricata 6.0.3

Topic		Replies	Views
How to record http access response body in Suricata 6.0.3 Help suricon	3	1372	November 15, 2021
How to log alert into a pcap Help	4	705	July 18, 2023
🔴 Hands-On Session: Detect Lateral Movement in Microsoft Environment with Suricata (Part 1) Announcements webinar	0	869	April 19, 2022
Suricata not trigger Alert via file Pcap record from Wireshark Help	5	684	June 8, 2023
Capture file not always exsits for alerts (Suricata v.7 Conditional PCAP)	4	409	April 23, 2023