suricata

Commit Graph

Author	SHA1	Message	Date
Juliana Fajardini	55b922ceed	tls/conf: clarify usage of custom vs extended logs Since enabling custom logging will replace the extended logging, thus possibly leading to certain fields disappearing from the logs, mention this aspect. Related to Bug #7333	5 months ago
Jeff Lucovsky	1e0d3435db	doc: add napatech plugin upgrade notes Issue: 7165	5 months ago
Jason Ish	6ae5ae701b	doc/userguide: generate eve documentation Add EVE documentation for QUIC and Pgsql to their respective sections of the userguide. Also add a complete EVE reference as an appendix. Other protocols can be done, but its a manual process to document in the schema, then add the glue to pull them into the documentation. The documentation is generated during "make dist", or if it doesn't exist, "conf.py" will attempt to generate the eve documentation for building on Readthedocs.	5 months ago
Philippe Antoine	bb714c9178	http: have a headers limit Ticket: 7191 So as to avoid quadratic complexity in libhtp. Make the limit configurable from suricata.yaml, and have an event when network traffic goes over the limit.	5 months ago
Philippe Antoine	e47598110a	detect/datasets: implement unset command Ticket: 7195 Otherwise, Suricata aborted on such a rule	5 months ago
Juliana Fajardini	18e0d23ed3	docs: remove mentions to Suricata-6 Task #7262	5 months ago
Juliana Fajardini	d1d1c8cdac	doc/conf/yaml: replace underscore with dashes Use sed + regex to replace all occurrences of suricata.yaml terms that used underscore for their up-to-date dash version. Also search for such terms in the eve-log.yaml partials file, as that is referenced in the configuration section. commands used: sed -i 's/\(^ [a-z]\)_\([a-z]:\)/\1-\2/g' sed -i 's/\(^ [a-z]\)_\([a-z]\)_\([a-z]*:\)/\1-\2-\3/g' Some other instances were found manually. Task #7260	5 months ago
Philippe Antoine	7ab833471e	doc/rfb: mention accidental fix for security_result log Ticket: 7198	5 months ago
Giuseppe Longo	036b68b0a9	doc: add new sip keywords	5 months ago
Juliana Fajardini	ef63aa50e2	doc/configuration: improve emergency-recovery docs When removing mentions to `prune-flows` a few inconsistencies for how we write and refer to `emergency-recovery` were left behind, still.	5 months ago
Philippe Antoine	de9413c654	detect: safety for app-layer logging of stream-only rules If a stream-only rule matches, and we find a tx where we want to log the app-layer data, store into the tx data that we already logged, so that we do not log again the app-layer metadata Ticket: 7085	5 months ago
jason taylor	f46a8776ec	doc: add note about big endian for icmp_seq match	5 months ago
Juliana Fajardini	1420c83a87	doc/configuration: remove mention to prune-flows Although the `prune-flows` option was removed with `a5587fec2e`, when documentation for the suricata.yaml config file was added with `b252b0d`, this option was also included - as has remained until now.	5 months ago
Jeff Lucovsky	8064847fc6	doc: Document reference config setting Issue: 4974	5 months ago
Philippe Antoine	0ebb84538e	http2: add frames support Ticket: 5743 Why ? To add detection capabilities	6 months ago
Jason Ish	685baa9680	output-filedata: rename and document registration function Prefix registration function and pointer function type with SC, as well as document. Ticket: #7227	6 months ago
Jason Ish	b51eeb3ab5	output-file: rename and document registration function Rename OutputRegisterFileLogger to SCOutputRegisterFileLogger, add function documentation and include in userguide. Ticket: #7227	6 months ago
Jason Ish	14b648f286	output-streaming: rename and document registration Prefix the registration function and types with "SC", and add function documentation. Ticket: #7227	6 months ago
Jason Ish	1ebf33b3c9	output-tx: rename and document transaction logger registration Rename OutputRegisterTxLogger to SCOutputRegisterTxLogger to make it part of the public API as well as document. Ticket: #7227	6 months ago
Jason Ish	bb128e3959	devguide: more on low level logging Use the extending/output section to introduce the low level logging API. Ticket: #7227	6 months ago
Juliana Fajardini	f3e1095244	userguide: update Security Onion docs reference They have updated their docs domain, leading to the link we had returning a 404. Also checked the other links. Although some seem to only contain old traffic, they all still work.	6 months ago
Sascha Steinbiss	cb14e44780	userguide: fix spelling of `security_result` EVE field This ensures that the correct spelling of the `security_result` EVE field for RFB (as opposed to `security-result`) is also reflected in the documentation. Ticket: #7210	6 months ago
Shivani Bhardwaj	1345c6d1cb	doc/file-extraction: fix highlight syntax	6 months ago
Juliana Fajardini	682b199ea0	userguide: expand documentation for rule profiling The page about performance and rule profiling showed the table generated by rules profiling but didn't inform how to achieve nor find it. Task #4359	6 months ago
Jason Ish	15fe844ae7	syslog: deprecate The standalone syslog output is now deprecated for Suricata 8. Display a warning on use and add notes to the userguide. Ticket: #6544	6 months ago
Jason Ish	5853fb922d	tls-log: deprecate tls-log is now deprecated and will be removed in Suricata 9.0. Display a deprecation notice on use, and add notes to the user guide. Ticket: #6542	6 months ago
Jason Ish	ab26323a96	http-log: deprecate http-log is now deprecated and will be removed in Suricata 9.0. Display a deprecation notice on use, and add notes to the userguide. Issue: #6543	6 months ago
Victor Julien	688bd538cf	pcap: implement pcap-file-buffer-size option Allows easy specification of buffer size on the commandline. Ticket: #7155.	6 months ago
Juliana Fajardini	246acc7140	userguide: clarify flow:stateless explanation While not incorrect, the previous wording made the sentence almost paradoxical. While at it, also highlight a side effect that might not be so clear to users. Related to Bug #6976	7 months ago
Philippe Antoine	62a186ceef	detect/rfb: move keywords to rust Ticket: 7178 On the way, convert rfb.secresult to a generic integer with enumeration cf ticket 6723	7 months ago
Victor Julien	fa9cae3899	doc/userguide: document logging changes from 6 to 7 Minor other logging related improvements like clarifying language and improving formatting for pdf output.	7 months ago
Philippe Antoine	0b2ed97f36	ssh: frames support Ticket: 5734 Adds frames for SSH records, that come after banner, and before the data is encrypted. These records may contain cipher lists for instance.	7 months ago
Giuseppe Longo	70ed9f91d8	doc: add ldap protocol	8 months ago
Philippe Antoine	bce8f4b853	detect/ssh: remove deprecated keywords Ticket: 2377	8 months ago
Philippe Antoine	0a1062fad2	detect/mqtt: move keywords to rust Ticket: 4863 On the way, convert some keywords to use the first-class integer support. And helpers for pure rust the support for multi-buffer. Move the C unit tests about keyword mqtt.protocol_version to unit tests for generic integer parsing, and test version 5 instead of testing twice version 3. Also iterate all tx's messages for reason code as is done for other keywords. And allow detection on empty topics.	8 months ago
Jason Ish	5f516c5896	doc: add pf-ring plugin upgrade notes Ticket: #7162	8 months ago
Philippe Antoine	e0fd59a20d	doc: state that payload-length includes the gaps	8 months ago
Jason Ish	4d3d57249a	doc: update dns section of the eve format documentation	8 months ago
Jason Ish	d3c08b9643	doc: upgrade guide for dns logging changes Bug: #6281	8 months ago
Sascha Steinbiss	53c62432c6	doc: update MQTT configuration	8 months ago
Shivani Bhardwaj	c66f1f4488	doc: add note about datasets string memcaps Bug 3910	8 months ago
Victor Julien	afc318737a	doc/userguide: document threshold backoff type	8 months ago
Victor Julien	e362a01f8d	doc/userguide: document new threshold config options	8 months ago
Victor Julien	405491c3fc	detect/detection_filter: add support for track by_flow	8 months ago
Victor Julien	3f04af7c7f	doc: add thresholding by_flow	8 months ago
Jeff Lucovsky	01e20c91fb	doc/transform: Correct typo	8 months ago
Jeff Lucovsky	d205ff82d0	doc/transform: Describe the from_base64 transform Issue: 6487 Document the new transform and indicate that it's the preferred way to perform base64 decoding (preferred over base64_decode)	8 months ago
Philippe Antoine	c9ce43b31e	output: configurable payload_length field for alerts Ticket: 7098	8 months ago
Victor Julien	3d059611c3	detect: add tls.alpn keyword Ticket: #7108.	8 months ago
Victor Julien	c79a382e42	eve/tls: log ALPN for client and server Part of the extended logging. Logs `client_alpns` and `server_alpns` arrays in the tls object. Ticket: #7055.	8 months ago

1 2 3 4 5 ...

1043 Commits (2e788408c07fb8043ed32f5694529ea1434ed618)