Please include the following information with your help request:
- Suricata version: 7.0.4
- Operating system and/or Linux distribution: RHEL8
- How you installed Suricata: From official package
The suricata_alerts dataset seems to used fully-expanded IP6 fields, for example for the format:
2620:0149:0004:3d99:fc4e:ec13:0247:6c28,
instead of:
2620:149:4:3d99:fc4e:ec13:247:6c28.
Consider many other systems are using the “A Compact Representation of IPv6 Addresses: RFC 1924 - A Compact Representation of IPv6 Addresses”.
In order to better co-operate/co-reference during network analysis operations, is there a way to configure the Suricata into the compact IPv6 format version into its output log/alert? If this is not available now, is it in the development roadmap?
Many Thanks!
br./Aaron