suricata

Commit Graph

Author	SHA1	Message	Date
Jason Ish	8c9a5590d3	rust: hoist serde_json dependency into workspace	5 days ago
Jason Ish	c919b5f7e5	rust: hoist serde dependency into workspace	5 days ago
Jason Ish	06441ef392	rust: hoist once_cell dependency into workspace	5 days ago
Jason Ish	065dc02ae6	rust: hoist clap dependency into workspace	5 days ago
Jason Ish	e979f6d523	rust: inherit common package metadata from workspace	5 days ago
Jason Ish	e9b08dbb2d	rust: clippy fixups for 1.97 Mostly provided by clippy --fix, and one `.to_string()` removal where not needed.	4 months ago
Jason Ish	dce2deee5e	rust: pin unicode-segmentation crate to 1.12.0 unicode-segmentation (used by rustyline) was updated from 1.12.0 to 1.13.1 earlier and requires a newer version of Rust. Pin to 1.12.0 which works with Rust 1.75.0.	7 months ago
Philippe Antoine	ebe0ba4ebb	rust: limit clap verson to 4.5.57 clap 4.5.58 and further requires edition2024 which is incompatible with MSRV	7 months ago
Jason Ish	0990c9dbf6	rust: pin indexmap Newer indexmap, pulled in by serde_json requires Rust 1.82, so pin pack to 2.11.4 which still works with Rust 1.75.	1 year ago
Eric Leblond	dd94dc6cc6	datajson: introduce feature This patch introduces new option to dataset keyword. Where regular dataset allows match from sets, dataset with json format allows the same but also adds JSON data to the alert event. This data is coming from the set definition it self. For example, an ipv4 set will look like: [{"ip": "10.16.1.11", "test": "success","context":3}] The syntax is a JSON array but it can also be a JSON object with an array inside. The idea is to directly used data coming from the API of a threat intel management software. The syntax of the keyword is the following: dataset:isset,src_ip,type ip,load src.lst,format json, \ enrichment_key src_ip, value_key ip; Compare to dataset, it just have a supplementary option key that is used to indicate in which subobject the JSON value should be added. The information is added in the even under the alert.extra subobject: "alert": { "extra": { "src_ip": { "ip": "10.6.1.11", "test": "success", "context": 3 }, The main interest of the feature is to be able to contextualize a match. For example, if you have an IOC source, you can do [ {"buffer": "value1", "actor":"APT28","Country":"FR"}, {"buffer": "value2", "actor":"APT32","Country":"NL"} ] This way, a single dataset is able to produce context to the event where it was not possible before and multiple signatures had to be used. The format introduced in datajson is an evolution of the historical datarep format. This has some limitations. For example, if a user fetch IOCs from a threat intel server there is a large change that the format will be JSON or XML. Suricata has no support for the second but can support the first one. Keeping the key value may seem redundant but it is useful to have it directly accessible in the extra data to be able to query it independantly of the signature (where it can be multiple metadata or even be a transformed metadata). In some case, when interacting with data (mostly coming from threat intel servers), the JSON array containing the data to use is not at the root of the object and it is ncessary to access a subobject. This patch implements this with support of key in level1.level2. This is done via the `array_key` option that contains the path to the data. Ticket: #7372	1 year ago
Jason Ish	1aaf5cb7d2	rust: allow some lints in suricatactl and suricatasc These are lints we allow in the Suricata Rust source code for style reasons.	1 year ago
Jason Ish	89ba53272c	suricatasc: reconnect on loss of connection If the connection is lost (for example, Suricata is restarted), try to re-open the connect and re-execute the command. This was the behavior of the Python implementation. Ticket: #7746	1 year ago
Jason Ish	e7366e43b5	rust: update deps Update all deps with cargo update. Additionally, apply the updated versions to the Cargo.toml, which while not stricly required, does make it more clear what the version in use is.	1 year ago
Jason Ish	7de03a5ef3	rust: update clap and rustyline With a MSRV of 1.75.0 we can now use current Clap. Rustlyline is updated, but still needs to be held back from the most current release.	1 year ago
Jason Ish	55a0d403cb	rust: unpin once_cell from old version We can now update to the current version of once_cell with Rust 1.75.	1 year ago
Jason Ish	66e47a1983	rust: pin once_cell to work with Rust 1.67.1 Clap uses once_cell which recently released v1.20 which updated its MSRV to 1.70. Locally pin once_cell to 1.20.3 to maintain our MSRV.	2 years ago
Jason Ish	8115669602	suricatasc: a Rust implementation of suricatasc This is a re-implementation of suricatasc program in Rust that attempts to be a 100% drop-in replacement.	2 years ago

17 Commits (3d4e51023ca92a6e49314e4fad7fa25c951b19d0)