rule-parser: quote string prefix handling

jasonish / evebox

Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search

https://evebox.org/

MIT License

432 stars 67 forks source link

rule-parser: quote string prefix handling #182

Closed jasonish closed 3 years ago

jasonish commented 3 years ago

In the case of a quote strings that has some prefix data, separate the prefix from the value. For example:

content:!"Firefox/3.6.13"

would previous have a value of "!Firefox/3.6.13" which is incorrect, now the value will be "Firefox/3.6.13" with the string before the opening quote available in the prefix field.

Github issue: https://github.com/jasonish/evebox/issues/176