How to record http access response body in Suricata 6.0.3

You might be interested in this thread - Forensic mode for full logging - #3 by Jeff_Lucovsky

looks like this feature is still not merged though Forensic mode rust v1.10 by regit · Pull Request #5688 · OISF/suricata · GitHub

Though I suspect in practice this feature would be performance impacting.

However, I do believe that if an alert had fired, the alert log can be configured to contain not only the http payload, but the more generic packet payload as well
https://suricata.readthedocs.io/en/latest/output/eve/eve-json-output.html#alerts

There was also a talk at Suricon regarding an upcoming feature for “conditional full packet capture”
the recording of the talk can be found here - New for Suricata 7: Conditional PCAP - YouTube

2 Likes