Hello all,
I write rules this:
alert http any any -> any any (msg:“File stored”; filename:“baofeng.zip”; filestore; sid:111111114; rev:1;)
I want to save file baofeng.zip
I find suricata save the baofeng.zip by log,but state is truncated and size is less and sha256 is bad.
It likely a part of file,so state is truncated.
If this,how can i save the file content?
Are you using file-store v2?
Sounds like you might be hitting stream depth settings.
See https://suricata.readthedocs.io/en/latest/file-extraction/file-extraction.html#settings
Try setting stream-depth: 0 in the file-store section of suricata.yaml
