I write rules this:
alert http any any -> any any (msg:“File stored”; filename:“baofeng.zip”; filestore; sid:111111114; rev:1;)
I want to save file baofeng.zip
I find suricata save the baofeng.zip by log,but state is truncated and size is less and sha256 is bad.
It likely a part of file,so state is truncated.
If this,how can i save the file content?
Are you using file-store v2?
Sounds like you might be hitting stream depth settings.
stream-depth: 0 in the file-store section of suricata.yaml