Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

De only/70x/v1 #12241

Closed
wants to merge 2 commits into from
Closed

De only/70x/v1 #12241

wants to merge 2 commits into from

Conversation

victorjulien
Copy link
Member

@victorjulien
detect: fix decoder only events
344802f 
Add missing setup part of the decoder event sgh.

Bug: OISF#7414.
(cherry picked from commit b23fa51)
@victorjulien
eve/alert: enrich decoder event
e09b263 
Default decoder event alert was very sparse, not even logging packet
type and pcap_cnt. Expand support for this record type. It will be more
useful with the ethernet headers and packet field, but these are still
disabled by default.

Ticket: OISF#7433.
(cherry picked from commit 2fe2cf8)
@codecov Codecov
Copy link

codecov bot commented Dec 6, 2024 •
edited
Loading

Codecov Report

Attention: Patch coverage is 85.71429% with 2 lines in your changes missing coverage. Please review.

Project coverage is 83.18%. Comparing base (825eadf) to head (e09b263).
Report is 6 commits behind head on main-7.0.x.

Additional details and impacted files 
@@             Coverage Diff             @@
##           main-7.0.x   #12241   +/-   ##
===========================================
  Coverage       83.17%   83.18%           
===========================================
  Files             922      922           
  Lines          260858   260866    +8     
===========================================
+ Hits           216979   217009   +30     
+ Misses          43879    43857   -22
Flag Coverage Δ
fuzzcorpus 64.17% <78.57%> (+0.02%) ⬆️
suricata-verify 63.37% <85.71%> (-0.03%) ⬇️
unittests 62.37% <0.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

inashivb
inashivb approved these changes Dec 6, 2024
View reviewed changes
Copy link
Member

@inashivb inashivb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀

@suricata-qa
Copy link

Information:

ERROR: QA failed on SURI_TLPW2_autofp_suri_time.

field baseline test %
SURI_TLPR1_stats_chk
.uptime 650 698 107.38%

Pipeline 23708

jufajardini
jufajardini approved these changes Dec 6, 2024
View reviewed changes
Copy link
Contributor

@jufajardini jufajardini left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good to me too, will probably add the rule in the ticket to my extended rule-types test, too, to have more de_only there.

@victorjulien victorjulien mentioned this pull request Dec 7, 2024
Merged
@victorjulien
Copy link
Member Author

Merged in #12244, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@inashivb inashivb inashivb approved these changes

@jufajardini jufajardini jufajardini approved these changes

@jasonish jasonish jasonish approved these changes

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@victorjulien @suricata-qa @jasonish @jufajardini @inashivb