Add payload-only-classtypes filtering to suricata conf to filter payl…

[Aboussejra]

…oad dump by classtype if needed

Make sure these boxes are checked accordingly before submitting your Pull Request -- thank you.

Contribution style:

• I have read the contributing guide lines at
  https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html

Our Contribution agreements:

• [x ] I have signed the Open Information Security Foundation contribution agreement at
  https://suricata.io/about/contribution-agreement/ (note: this is only required once)

Changes (if applicable):

• I have updated the User Guide (in doc/userguide/) to reflect the changes made
• [x ] I have created a ticket at
  https://redmine.openinfosecfoundation.org/projects/suricata/issues

Link to ticket: https://redmine.openinfosecfoundation.org/issues/8245

Describe changes:

Add a new configuration option to filter payload extraction in EVE JSON alerts based on the rule's classtype.

Currently, when payload: yes is enabled in the alert output, payloads are extracted for all alerts. In some environments we want payloads to be extracted only for specific rules (and we use classtypes for that).

I envision adding an optional payload-only-classtypes configuration parameter under the alert output type that accepts a list of classtype names.

When configured:

• Payloads are only extracted for alerts whose classtype matches one in the list
• If the list is empty or not configured, the default behavior is preserved (payloads extracted for all alerts when payload: yes)

Suricata-verify MR: OISF/suricata-verify#2885

Provide values to any of the below to override the defaults.

• To use a Suricata-Verify or Suricata-Update pull request,
  link to the pull request in the respective _BRANCH variable.
• Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=
SU_REPO=
SU_BRANCH=

[catenacyber]

Thanks for the work.

I think this feature needs

• a ticket
• some SV test
• some documentation addition

[Aboussejra]

Thanks for the work.

I think this feature needs

* a ticket

* some SV test

* some documentation addition

Sure ! I am working on it ! ticket is here https://redmine.openinfosecfoundation.org/issues/8245

I am currently looking at SV to add a test and will link it as soon as I did it.

Understood for the documentation part, I will look into it !

[Aboussejra]

Suricata-verify MR is at OISF/suricata-verify#2885

[catenacyber]

Please open a new v2 PR, see https://docs.suricata.io/en/latest/devguide/contributing/code-submission-process.html#pull-requests

[Aboussejra]

Indeed, opened here:
#14682