sagan

sagan copied to clipboard

Error with variables for alert_time keyword

1

Summary: When implementing a rule set for a customer utilizing the alert_time keyword coupled with custom Day and Hours variables an error is given stating: "[E] [04/19/2022 17:27:03] - [rules.c,...

Vernaculus

** Please note ** This repo has moved! Please use https://github.com/quadrantsec/sagan . Please post feature requests and bug reports there. Thank you!

beave

Match content on normalized fields

12

I have an idea for a useful feature. I think being able to match content, pcre, etc. on specific fields that are normalized would be really useful. In variable length...

jonschipp

xbit to track usernames.

1

From Steve: "Create flowbits based on anything found in a log. For instance, pull a username from a log and create a flowbit named the same as the username (user...

beave

Output Options / FIFO

5

**Is your feature request related to a problem? Please describe.** Sagan can currently only output eve logs to regular file, and only one at a time. **Describe the solution you'd...

SpudDogg

Document purpose of "hostname" field

1

**Is your feature request related to a problem? Please describe.** JSON mapping includes a "hostname" field, but I am unclear as to what this is used for. I *could* map...

candlerb

**Is your feature request related to a problem? Please describe.** I have some issues around the "date" and "time" fields which come from syslog, either as pipe-delimited fields or as...

candlerb

Apache Kafka Integration

2

**Is your feature request related to a problem? Please describe.** No **Describe the solution you'd like** Use Apache Kafka Queue(s) as a source of logs. also Kafka can used for...

Fadavvi

Sagan doesn't dump stats on -USR1 or shutdown (when in initab)

beave

Write "stat" data out to json, similar to how Suricata does it.

beave