Added vhost field to web rules

2024-11-06 17:35:19 +00:00 · 2017-09-17 00:20:17 +02:00 · 2017-09-17 00:20:17 +02:00 · 6b8a5aea4a
commit 6b8a5aea4a
parent 270ab9ba78
2 changed files with 2 additions and 0 deletions
--- a/rules/web/web_multiple_suspicious_resp_codes_single_source.yml
+++ b/rules/web/web_multiple_suspicious_resp_codes_single_source.yml
@ -14,6 +14,7 @@ detection:
    condition: selection | count() by clientip > 10
 fields:
    - client_ip
+    - vhost
    - url
    - response
 falsepositives:
--- a/rules/web/web_webshell_keyword.yml
+++ b/rules/web/web_webshell_keyword.yml
@ -11,6 +11,7 @@ detection:
    condition: keywords
 fields:
    - client_ip
+    - vhost
    - url
    - response
 falsepositives: