I’ve been working on a forensic mode for Suricata. This is a set of options that can be used to analyze data (mostly pcap files as it is really verbose) and get as much data as possible. The first one adds an option to log all HTTP headers in alert. As the alert is sometime on specific headers valu…

Forensic mode for full logging

Jeff_Lucovsky (Jeff Lucovsky) May 26, 2020, 11:59am 3

There are runtime configuration options for forensic mode (see doc/userguide/output/eve/eve-json-format.rst) but no configure options.

How to record http access response body in Suricata 6.0.3

Topic		Replies	Views
How to record http access response body in Suricata 6.0.3 Help suricon	3	1575	November 15, 2021
Use suricata to replay pcap file without any output Help	4	676	August 4, 2021
Suricata Sending Request & Response Bodies in multiple events due to alert rule Rules rules , suricata	3	275	April 25, 2024
Http.log failed to log all http\s events	7	705	February 21, 2023
How to log alert into a pcap Help	4	844	July 18, 2023