Commit Graph

301 Commits (15ed51f9b87011025615245d89152da9c567f49b)

Author SHA1 Message Date
Jason Ish c1a8dbcb72 doc/userguide: document dns.query.name, dns.answer.name
With some other minor cleanups in the DNS keyword section.
2 years ago
Shivani Bhardwaj b9540df5ad doc: clarify IP-only with iprep 2 years ago
jason taylor fc81c99b58 doc: add file.name information to smtp keyword doc
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 9d1ad0187e doc: add file.name information to nfs keyword doc
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 327ba7397a doc: add file.name information to smb keyword doc
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor e4077b8803 doc: update ftp keyword doc example rule format
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor bb1f7575d3 doc: add file.name information to ftp keyword doc
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor bbc17b1c7d doc: add file.name information to http keyword doc
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Philippe Antoine 32cce122e1 detect: header_lowercase transform
Ticket: 6290
2 years ago
jason taylor c50002978d doc: update file.data keyword documentation
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Sascha Steinbiss 0c55fe3515 detect: add mqtt.connect.protocolstring
Ticket:  OISF#6396
2 years ago
Victor Julien 6b2c33990f doc/userguide: add tag keyword page
Ticket: #3015.
2 years ago
Jeff Lucovsky 9ee55d2394 doc/transform: Document case-changing transforms.
Issue: 6439
2 years ago
Philippe Antoine ab9b6e30b1 detect: adds flow integer keywords
Ticket: #6164

flow.pkts_toclient
flow.pkts_toserver
flow.bytes_toclient
flow.bytes_toserver
2 years ago
jason taylor 535938d7f6 doc: add tls.cert_chain_len docs
Ticket: #6386

Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Travis Green 96a0e7016f doc: add tcp flags documentation
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor be324d7856 doc: update file.magic information
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 008cc78a03 doc: update fileext keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor e99b1787a2 doc: update file.name keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Andreas Herz da68692547 doc: dataset - add type to be mandatory 2 years ago
jason taylor c95fce39f0 doc: add multi buffer support note to keyword docs
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 88960e909d doc: add multiple buffer matching documentation
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Jeff Lucovsky 47e268d609 detect/byte_math: Document bytes variable name
Issue: 6145

Document that byte_math accepts a variable name for bytes (optional)
2 years ago
Jeff Lucovsky 3a4554fc2b detect/byte-jump: Document var usage for nbytes
Issue: 6105
2 years ago
Jeff Lucovsky 73b943276e doc/byte_test: Document byte_test variable usage
Issue: 6144

This commit updates the byte_test documentation now that a variable name
can be used for the nbytes value.
2 years ago
Shivani Bhardwaj b6f8f5eb3b doc/http: use "sticky buffer" where applicable 2 years ago
Jason Ish 14daa42e0b doc/userguide: dataset upgrade notes 2 years ago
Jason Ish 4a97461f9a doc/userguide: notes about Lua rules being disabled by default 2 years ago
Philippe Antoine 415b036dca http1: implement http.request_header
So that it is generic for HTTP1 and HTTP2

Ticket: #5780
2 years ago
Philippe Antoine 7256ec8a6e detect/http2: do not escape ':' in header name or value
for keywords http.request_header and http.response_header

Ticket: #5780
2 years ago
Philippe Antoine 656554f293 http2: rename http2.header to http.request_header
Or http.response_header based on the direction

http2.header had a different behavior than http.header and this was
confusing.

Ticket: #5780
2 years ago
Eloy Pérez González b3c7130749 krb5: update krb5_msg_type keyword docs 2 years ago
Victor Julien 0903536fd6 doc: spelling
Thanks to Josh Soref.
2 years ago
Philippe Antoine 9bd2b72e2b doc: explain where tls.store stores certificates
By adding a reference/link to the doc about the suricata.yaml
config section pecifying the directory where the certificates
are stored
2 years ago
Victor Julien c0d9b3c078 doc/userguide: spelling 2 years ago
Andreas Herz 3045e75ee1 doc: add note on the hashsize recommendation for datasets 2 years ago
Philippe Antoine 59734d16a1 detect: use http.connection to client
Ticket: #5746
2 years ago
Philippe Antoine 6bc7f02e13 doc: rules can have http1 as protocol
Ticket: #5962
2 years ago
Jeff Lucovsky fd46c93a8f doc/byte_math: Add divide by 0 discussion.
Issue: 5945
2 years ago
Jeff Lucovsky 35bbdf4124 doc/content: Add limits for distance/within
Ticket: 5740
2 years ago
Shivani Bhardwaj 0f3e7761da doc: add dataset examples 2 years ago
Haleema Khan 609df1776e userguide: update tls keywords information
Ticket #5544
2 years ago
jason taylor 0632233791 userguide: update http.cookie description
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
Jeff Lucovsky 197ad51138 doc: Update bsize documentation
This commit updates the bsize documentation

1. Describe what happens when "content" immediately precedes "bsize"
2. Include the operators and
3. Include examples using the operators.
3 years ago
jason taylor 9dc8fffe05 userguide: update tos keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 1d9b91a987 userguide: update fragoffset keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 7c73144988 userguide: update fragbits information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 4be9793e36 userguide: update geoip information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor e8eba6e4a1 userguide: update id keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor cfd0da133e userguide: update ipv6.hdr keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago