Logging Network Firewall Stateful rule logs

Question

maybe i already got an answer in my mind but still ill left this question here.

My team try to deploy AWS native network firewall insted of 3rd party firewall like Fortinet, Paloalto to our customer.

So we currently working on various case scenario with rules. and what make us bugging  is standard rules like rules inside 5-tuple-rule groups seem to not have ability to left their rule id or something like that on log regardless of its alert or just flow.

Im sure this could be a huge pain in the a@# to the infra/security administrator when they dealing with trouble shooting some traffic flow related issues.

So what i want to know is is there any CLI hidden options to enable rule id or again Suricata custom rule is the answer?

Vincent · Accepted Answer

To log custom messages, you can use the "msg" keyword in Suricata rules, see [here](https://suricata.readthedocs.io/en/suricata-6.0.1/rules/meta.html#:~:text=1.-,msg%20(message),signature%20and%20the%20possible%20alert.&text=It%20is%20convention%20to%20make,first%20keyword%20in%20the%20signature.).

Logging Network Firewall Stateful rule logs

Relevant content