213 Commits (0d8c81c062ce8d475a3373d5452c2cc6e161f157)

Author	SHA1	Message	Date
Philippe Antoine	1df568300c	doc/jsonschema: use dnp3_func instead of its alias	9 months ago
Juliana Fajardini	331bc8aeac	schema: add descriptions to global memcaps/memuses ... For FTP, Host, IP Pair and HTTP. Related to Task #6434	9 months ago
Juliana Fajardini	2855574a2c	schema: add additional properties to stats.capture ... The `stats.capture` object may have different properties based on the capture method used. This adds the ones pertaining to AF_PACKET capture. Related to Task #6434	9 months ago
Juliana Fajardini	12e0e51864	schema: add desc for each main stats module ... Part of the schema documentation effort. Related to Task #6434	9 months ago
Juliana Fajardini	025ffa6135	schema: allow stats.stream event counters ... While the counters exist, they're not present in the schema, causing validation to fail if stats.stream-events is enabled. Task #7858	9 months ago
Juliana Fajardini	173fec81f8	schema/stats: flow_mgr is actually flow.mgr ... The schema accounts for a stats counters group that is a subgroup of the flows stats counters. Remove `flow_mgr`, thus.	9 months ago
Philippe Antoine	85fa894425	detect: dnp3.func is now a generic integer ... Ticket: 7889	9 months ago
Victor Julien	acb769291a	exception-policy: add 'reject-both' option ... Allow rejecting both sides of a connection. Has the same support as regular reject (which is essentially rejectsrc). Ticket: #5974.	9 months ago
Philippe Antoine	047f1c5080	doc: fix enip_command name in json schema ... enip.command is not a keyword nor an alias	10 months ago
Philippe Antoine	969739d067	detect: http2.errorcode is now a generic integer ... Ticket: 7889	10 months ago
Jason Ish	5e2dc9ace3	ike: don't log empty server objects	10 months ago
Jason Ish	2d86412f46	ike: log attributes as objects ... IKE attributes are an array of TLV style objects, this means there can be duplicate types seen on the wire. However, Suricata logs these as a mapping with the type as the key. This can result in the JSON containing duplicate keys. To address this, log the attributes as an array of objects, allow duplicates to exist, for example: "client": { "proposals": [ { "sa_life_duration": "Unknown", "sa_life_duration_raw": 86400, } } } is now logged as: "client": { "proposals": [ {"key": "sa_life_duration", "value": "Unknown", "raw": 86400} ] } Also adds `"version": 2` to each IKE record to note the change of format from previous versions. Ticket: #7902	10 months ago
Juliana Fajardini	426955782c	schema: add descriptions to capture stats counters ... Task #6434	10 months ago
Juliana Fajardini	3642594e14	schema: add descriptions to decoder stats counters ... Continuation of Task #7793	10 months ago
Juliana Fajardini	42d563f83e	schema: fix typos s/ERPSAN/ERSPAN	10 months ago
Philippe Antoine	4f7fc25a1a	detect/dnp3: make dnp3.ind a generic uint16 bitflags keyword ... Ticket: 6724 Allows operations such as negation	11 months ago
Fupeng Zhao	e79d735374	decode/etag: ETag 802.1BR decoder ... Ticket: #3953.	11 months ago
Philippe Antoine	dae9264120	doc: really enforce more the completeness of json schema ... Completes commit f1f32a39ee End better describe exception_policy	11 months ago
Philippe Antoine	2028a3f9f8	doc: complete json schema with integer keywords	11 months ago
Philippe Antoine	f1f32a39ee	doc: enforce more the completenes of json schema ... see jq 'paths( objects | (.type == "object" and (has("additionalProperties") | not) )) | join(".")' etc/schema.json fix and complete bittorrent on the way	11 months ago
Philippe Antoine	421fb8ac31	doc/ldap: complete json schema	11 months ago
Jeff Lucovsky	17e7387ff4	doc/fileinfo: Document fileinfo context/usage ... Issue: 6498	11 months ago
Juliana Fajardini	8f9f414866	schema: document stats.detect counters ... ... that were missing. Task #7795	11 months ago
Juliana Fajardini	051715a7eb	schema/description: capitalize initial letters ... For existing descriptions that weren't like that, yet.	12 months ago
Juliana Fajardini	1d27e268d1	schema: add descriptions for flow stats counters ... Task #7794	12 months ago
Juliana Fajardini	49629f7cb6	schema/decoder: add descriptions for stats counters ... Task #7793	12 months ago
Juliana Fajardini	342c649186	schema/arp: fix invalid pkt event output ... Task #7857	12 months ago
Juliana Fajardini	a8453d73cd	detect: remove unused non-pf stats counters ... Remove unused rule prefilter-related stats counters that aren't in use. 94644ac960 (detect: move non-pf rules into special prefilter engines) removed the logic that made use of and incremented the stats counters: - det_ctx->counter_fnonmpm_list - det_ctx->counter_nonmpm_list Some code was left, registering them, and mentioning them in the json schema. Ticket #7834	1 year ago
Philippe Antoine	fe9da8acd6	http2: do not log empty objects for request or response ... Ticket: 7741	1 year ago
Jeff Lucovsky	97b03b4076	doc/netflow: Discuss netflow ... Add discussion for netflow configuration, event type and fields contained in netflow records. Issue: 5139	1 year ago
Philippe Antoine	f4378eb306	doc/devguide: document app-layer protocol detection ... Ticket: 6022	1 year ago
Philippe Antoine	68827a4ace	schema: document kerberos fields ... Ticket: 6566	1 year ago
Jason Ish	ddb77d061e	eve/schema: map mdns properties that have keywords ... Also add descriptions for the EVE index.	1 year ago
Juliana Fajardini	cbe621fb09	decode: add stats counters for ipv4/ipv6 over ipv4 ... These existed for ipv6 over ipv6, and ipv4 over ipv6, but not for the ipv4 counterpart. Task #7758	1 year ago
Eric Leblond	23f643a4a7	eve/schema: fix ordering	1 year ago
Eric Leblond	b03d4f8e1a	datajson: output context to "context" ... Using `alert.extra` was not really reflecting the nature of what was added. So renaming it to `alert.context`.	1 year ago
Eric Leblond	61ac7b46c1	eve/schema: remove reference to datajson	1 year ago
Eric Leblond	e2d8217934	eve/schema: document datajson output	1 year ago
Eric Leblond	0e88e36020	eve/schema: pktvars is a container ... It can contain any vars so need addition properties.	1 year ago
Alice Akaki	3065374314	json/schema: link file.name to email.attachment ... As a Suricata keyword. Ticket: #7683	1 year ago
Victor Julien	df7fe5b0ce	detect: add pre_flow hook ... Allows dropping of packets before a flow is created/updated. Directionless as direction is inferred from the flow. Ticket: #7714.	1 year ago
Victor Julien	8f2b925e09	detect: add pre_stream hook ... Meant to be used from the detection engine, to allow rules to drop traffic before it modifies the stream state. Ticket: #7712.	1 year ago
Victor Julien	17ed70dcb5	eve/schema: reformat with clang-format	1 year ago
Jeff Lucovsky	a292670443	detect/entropy: Add calculated entropy value to flowvars ... When the entropy keyword is used, record the calculated entropy value to a flow variable for logging use.	1 year ago
Juliana Fajardini	f3aa0085a0	pgsql: rename copy in/out response field ... We used `copy_column_count`, while just `columns` is more accurate with what PostgreSQL describes, and what Wireshark shows. Related to Task #7644 Task #7645	1 year ago
Juliana Fajardini	2086f99d6b	pgsql: add initial support to CopyIn mode/subproto ... This sub-protocol inspects messages sent mainly from the frontend to the backend after a 'COPY FROM STDIN' has been processed by the backend. Parses new messages: - CopyInResponse -- initiates copy-in mode/sub-protocol - CopyData (In) -- data transfer message, from frontend to backend - CopyDone -- signals that no more CopyData messages will be seen from the frontend, for the current transaction - CopyFail -- used by the frontend to signal some failure to proceed with sending CopyData messages Task #7645	1 year ago
Juliana Fajardini	d5c48259de	schema/psgql: fix fields order	1 year ago
Juliana Fajardini	3febbcbf1c	pgsql: document CopyOut messages ... Related to Task #7644	1 year ago
Jason Ish	4a655053e8	mdns: add mdns parser, logger and detection ... The mDNS support is based heavily on the DNS support, reusing the existing DNS parser where possible. This meant adding variations on DNS, as mDNS is a little different. Mainly being that *all* mDNS traffic is to_server, yet there is still the concept of request and responses. Keywords added are: - mdns.queries.rrname - mdns.answers.rrname - mdns.additionals.rrname - mdns.authorities.rrname - mdns.response.rrname They are mostly in-line with the DNS keywords, except mdns.answers.rdata which is a better than that mdns.response.rrname, as its actually looking at the rdata, and not rrnames. mDNS has its own logger that differs from the DNS logger: - No grouped logging - In answers/additionals/authorities, the rdata is logged in a field that is named after the rdata type. For example, "txt" data is no longer logged in the "rdata" field, but instead a "txt" field. We currently already did this in DNS for fields that were not a single buffer, like SOA, SRV, etc. So this makes things more consistent. And gives query like semantics that the "grouped" object was trying to provide. - Types are logged in lower case ("txt" instead of "TXT") - Flags are logged as an array: "flags": ["aa", "z"] Ticket: #3952	1 year ago
Jeff Lucovsky	9cb54f747d	decode/sll2: Support PCAPs encoded with Linux SLL ver 2 ... Support Linux Cooked mode v2 -- DLT 276	1 year ago