Include the 'short name' from classification.config in the all-eve.log

Help
1

Hello. Is there a way to have suricata include the ‘short name’ of a classtype (from classification.config) in the all-eve.log? Suricata includes the classification description but not the ‘short name’.

For example, config classification: successful-admin,Successful Administrator Privilege Gain,1 I’d like to include successful-admin

Thanks.

2

Hi, Did you find a solution to this ? I’d like to do the same thing.

3

Overlooked this back in June. There is no way to do this currently, but it probably wouldn’t be hard. Feel free to open a feature ticket for it.

4

Hi,

Thanks. I hate to ask such a ‘stupid’ question … but it is not obvious to me where to submit a feature ticket.

Thanks,

Michael

5

Its not a stupid question. Its perfectly alright to ask. :slight_smile:
Please do so on https://redmine.openinfosecfoundation.org

1 Like
6

Thanks, Victor and Shivani. I ended up using the classification description for our needs, but I will definitely submit a feature request for this, too.

7

Seems there is a bit of recent movement on a feature request I made:

Thanks, everyone