Added HTTP filters in historical flows (#7535)

This commit is contained in:
Matteo Biscosi 2023-06-27 15:30:45 +00:00
parent 559dec5b1e
commit 74583a3b7b
4 changed files with 1054 additions and 792 deletions

View file

@ -1237,6 +1237,10 @@ function historical_flow_utils.get_tags()
flow_defined_tags["l7_error_id"] = tag_utils.defined_tags["l7_error_id"]
flow_defined_tags["ja3_client"] = tag_utils.defined_tags["ja3_client"]
flow_defined_tags["ja3_server"] = tag_utils.defined_tags["ja3_server"]
flow_defined_tags["http_method"] = tag_utils.defined_tags["http_method"]
flow_defined_tags["http_url"] = tag_utils.defined_tags["http_url"]
flow_defined_tags["http_return"] = tag_utils.defined_tags["http_return"]
flow_defined_tags["user_agent"] = tag_utils.defined_tags["user_agent"]
flow_defined_tags["cli_location"] = tag_utils.defined_tags["cli_location"]
flow_defined_tags["srv_location"] = tag_utils.defined_tags["srv_location"]
flow_defined_tags["traffic_direction"] = tag_utils.defined_tags["traffic_direction"]

View file

@ -1847,6 +1847,10 @@ local known_parameters = {
["role"] = validateListOfTypeInline(validateFilters(validateSingleWord)), -- attacker/victim
["role_cli_srv"] = validateListOfTypeInline(validateFilters(validateSingleWord)), -- client/server
["l7_error_id"] = validateListOfTypeInline(validateFilters(validateNumber)), -- client/server
["http_method"] = validateListOfTypeInline(validateFilters(validateSingleWord)), -- client/server
["http_return"] = validateListOfTypeInline(validateFilters(validateNumber)), -- client/server
["http_url"] = validateListOfTypeInline(validateFilters(validateSingleWord)), -- client/server
["user_agent"] = validateListOfTypeInline(validateFilters(validateSingleWord)), -- client/server
["confidence"] = validateListOfTypeInline(validateFilters(validateNumber)), -- client/server
["acknowledged"] = validateListOfTypeInline(validateFilters(validateSingleWord)), -- acknowledged
["community_id"] = validateListOfTypeInline(validateFilters(validateSingleWord)), -- Community ID

File diff suppressed because it is too large Load diff