Add payload-only-classtypes filtering to suricata conf to filter payl…

[Aboussejra]

…oad dump by classtype if needed

Make sure these boxes are checked accordingly before submitting your Pull Request -- thank you.

Contribution style:

• I have read the contributing guide lines at
  https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html

Our Contribution agreements:

• [x ] I have signed the Open Information Security Foundation contribution agreement at
  https://suricata.io/about/contribution-agreement/ (note: this is only required once)

Changes (if applicable):

• I have updated the User Guide (in doc/userguide/) to reflect the changes made
• [x ] I have created a ticket at
  https://redmine.openinfosecfoundation.org/projects/suricata/issues

Link to ticket: https://redmine.openinfosecfoundation.org/issues/8245

Describe changes:

Add a new configuration option to filter payload extraction in EVE JSON alerts based on the rule's classtype.

Currently, when payload: yes is enabled in the alert output, payloads are extracted for all alerts. In some environments we want payloads to be extracted only for specific rules (and we use classtypes for that).

I envision adding an optional payload-only-classtypes configuration parameter under the alert output type that accepts a list of classtype names.

When configured:

• Payloads are only extracted for alerts whose classtype matches one in the list
• If the list is empty or not configured, the default behavior is preserved (payloads extracted for all alerts when payload: yes)

Provide values to any of the below to override the defaults.

• To use a Suricata-Verify or Suricata-Update pull request,
  link to the pull request in the respective _BRANCH variable.
• Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#2895
SU_REPO=
SU_BRANCH=

[catenacyber]

@Aboussejra could you check why CI is red ?

[Aboussejra]

@catenacyber

I think I understood the problem:

I missfilled the command field of the tests/test-filter-payload-extraction/test.yaml in suricata-verify. I opened a new MR v2 for suricata-verify, it should correct the problem. (Not sure how can I re-run the CI with the new suricata-verify to check).

https://github.com/OISF/suricata-verify/pull/2895/changes

[catenacyber]

Not sure how can I re-run the CI with the new suricata-verify to check

Maybe just rebase and resubmit a new PR

[Aboussejra]

@catenacyber

Understood, given the fact only the suricata-verify MR changed, I did not thought I had to resubmit a v3 MR for suricata.

but here it is: #14726

[Aboussejra]

v3 MR #14726