60 Commits (42a85c37f129cd984d77de19c6316fa245275457)

Author	SHA1	Message	Date
Jason Ish	a11aaadd86	plugins: add --plugin command line option to load plugins ... Add --plugin <PATH> to load an additional plugin from the command line. This is more convenient than "--set plugins.X" especially when you may already have a plugins loaded and you want to load an additional one. Ticket: 8463	4 months ago
Jeff Lucovsky	e7dc0d885b	doc/config: Update flushing description ... Update output flushing description to reflect EVE based approach in documentation and config template. Issue: 8286	5 months ago
Jeff Lucovsky	5a3a2d5fd1	doc/output: Document the IPv6 display behavior ... Issue: 7399 Document the IPv6 display behavior and how to display IPv6 addresses in their compressed form (per RFC-5952).	5 months ago
Ofer Dagan	e1f9d8a067	pcap: refactor delete-when-done to support non-alerts ... Refactor pcap file deletion to use a single delete-when-done option with three values instead of separate boolean options: - false (default): No deletion - true: Always delete files - "non-alerts": Delete only files with no alerts Also account for alerts produced by pseudo packets (flow timeout / shutdown flush): - Introduce small capture hooks and invoke on pseudo-packet creation so the capture layer can retain references and observe alerts emitted after the last live packet - Call the hook from both TmThreadDisableReceiveThreads and TmThreadDrainPacketThreads Key changes: - Replace should_delete/delete_non_alerts_only bools with enum - Move alert counter from global to per-file PcapFileFileVars - Relocate alert counting from PacketAlertFinalize to pcap module - Ensure thread safety for both single and continuous pcap modes - Add unit tests for configuration parsing and pseudo-packet alert path The --pcap-file-delete command line option overrides YAML config and forces "always delete" mode for backward compatibility. Documentation updated to reflect the new three-value configuration. Fixes OISF#7786	6 months ago
Fupeng Zhao	f7ec1c8813	redis: Add authentication support ... Add authentication support to the Redis logging output. It introduces `username` and `password` configuration options for Redis, allowing Suricata to authenticate with Redis servers that require it. Ticket: 7062	6 months ago
Jeff Lucovsky	1030e4fa92	doc/suricatasc: Mentioned get-flow-stats-by-id cmd ... Add get-flow-stats-by-id to the list of commands supported by suricatasc Issue: 7081	1 year ago
Lukas Sismis	eb52e337da	pcap-file: document capture method options	1 year ago
Jeff Lucovsky	a3a3ad8968	doc/output: EVE output buffering related settings	1 year ago
Sascha Steinbiss	285cc29ec0	redis: add automatic trimming support for streams	2 years ago
Sascha Steinbiss	d3d9f1c395	redis: implement XADD stream support ... Ticket: #7082	2 years ago
Jason Ish	cc519beb91	suricata.yaml: add missing custom tls fields ... Also update the suricata.yaml in the userguide.	2 years ago
Juliana Fajardini	d1d1c8cdac	doc/conf/yaml: replace underscore with dashes ... Use sed + regex to replace all occurrences of suricata.yaml terms that used underscore for their up-to-date dash version. Also search for such terms in the eve-log.yaml partials file, as that is referenced in the configuration section. commands used: sed -i 's/\(^ *[a-z]*\)_\([a-z]*:\)/\1-\2/g' sed -i 's/\(^ *[a-z]*\)_\([a-z]*\)_\([a-z]*:\)/\1-\2-\3/g' Some other instances were found manually. Task #7260	2 years ago
Jeff Lucovsky	8064847fc6	doc: Document reference config setting ... Issue: 4974	2 years ago
Victor Julien	688bd538cf	pcap: implement pcap-file-buffer-size option ... Allows easy specification of buffer size on the commandline. Ticket: #7155.	2 years ago
Philippe Antoine	e0fd59a20d	doc: state that payload-length includes the gaps	2 years ago
Sascha Steinbiss	53c62432c6	doc: update MQTT configuration	2 years ago
Philippe Antoine	c9ce43b31e	output: configurable payload_length field for alerts ... Ticket: 7098	2 years ago
Giuseppe Longo	8a171c9d74	doc: add arp changes	2 years ago
Juliana Fajardini	bb59124063	yaml: unify 0 stats counter config option terms ... When we added feature #5976 (72146b969), we overlook that we also have a config stats option for the human-readable stats logs to output 0 counters. Due to not seeing this before, we now have two different setting names for basically the same thing, but in different logs: - zero-valued-counters for EVE - null-values for stats.log This ensures we use the same terminology, and change the recently added one to `null-values`, as this one has been around for longer. Task #6962	2 years ago
Juliana Fajardini	72146b969c	eve/stats: allow hiding counters whose valued is 0 ... Some stats can be quite verbose if logging all zero valued-counters. This allows users to disable logging such counters. Default is still true, as that's the expected behavior for the engine. Task #5976	2 years ago
Victor Julien	c0201d3212	doc/userguide: add reload-tenant(s) doc	3 years ago
Victor Julien	6ba0956a75	multi-tenant: allow reload w/o yaml path ... Store yaml path in de ctx, for reloads w/o path. This allows for a simpler `reload-tenant N`, where the previously used yaml is reloaded.	3 years ago
Victor Julien	0903536fd6	doc: spelling ... Thanks to Josh Soref.	3 years ago
Victor Julien	c0d9b3c078	doc/userguide: spelling	3 years ago
Jason Ish	1b844cd7f7	doc/userguide: document --include command line option	4 years ago
Richard McConnell	b39a4c63fe	doc: document AF_XDP feature	4 years ago
Jason Ish	0ea9ba66d1	userguide/eve-log: remove mentions of requiring Rust ... Rust is required to build now.	4 years ago
Aaron Bungay	d166c48d28	docs: update for bittorrent-dht app-layer	4 years ago
jason taylor	db5cf1f8f9	userguide: Add rule file globbing option details ... Signed-off-by: jason taylor <jtfas90@gmail.com>	4 years ago
frank honza	ecdf9f6b0b	ikev1: rename ikev2 to common ike ... Renaming was done with shell commands, git mv for moving the files and content like find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.	6 years ago
Jason Ish	4b9af8d2ce	doc/userguide: document --disable-hashing	6 years ago
Victor Julien	ca47d75c80	doc/userguide: explain --strict-rule-keywords	6 years ago
Jason Ish	3030a3da18	doc: provide eve 1 deprecation date	6 years ago
Jeff Lucovsky	6f9b7e052a	doc/eve: Update threaded filename examples	6 years ago
Jason Ish	f70e1f571e	doc/userguide: add info about --set and lists	6 years ago
Jeff Lucovsky	06f41f608c	doc: Improve grammar, spelling and clarifications ... This commit improves the overall documentation's grammar, spelling, and adds clarifications where needed.	6 years ago
James Dutrisac	8d5e54c046	pcap: recusively reading pcaps / documentation ... Changes to doc/userguide/partials/options.rst for feature 2363 (reading pcaps recursively)	6 years ago
Jeff Lucovsky	a5d30a3220	doc/output: Document multithreaded eve option	6 years ago
Victor Julien	75727c05e0	doc/manpage: add --reject-dev option	6 years ago
Jeff Lucovsky	3385859176	doc/userguide: Update for dump-features	7 years ago
Daisu	fccdb1c642	doc/commandline: -i option is useable several times	7 years ago
Jason Ish	9111b9df57	doc: cleanup enging logging ... Attempt cleanup the engine logging a bit. Also a include a verbatim excerpt of the default configuration here for reference purposes.	7 years ago
Jason Ish	c97195bf0b	doc: -v verbose option documentation update ... Update -v documentation to reflect the new behaviour discussed in bug #1851 where -v changes the log level to fixed levels instead of an offset of the default log level configured in suricata.yaml.	7 years ago
Jeff Lucovsky	17c3e22ecd	doc/eve.alert: Expand metadata description	7 years ago
Jason Ish	9488002a0d	doc: use describe instead of option for old Sphinx ... Older versions of Sphinx will generate duplicate IDs when you have options like: .. option:: some-option .. option:: some-other-option The version of Sphinx provided on CentOS 7 has this issue, newer versions of Sphinx do not. As CentOS 7 is still a popular distribution, change ".. option" to ".. describe" which has the same visual output, but does not generate links.	7 years ago
Shivani Bhardwaj	4705314fd2	doc: Add manpages for suricatasc and suricatactl ... Add the missing manpages and the corresponding Sphinx configuration for the command line tools `suricatasc` and `suricatactl`. Closes redmine ticket #884.	7 years ago
Jason Ish	75a018ead2	doc: remove autoconf replacement var for Rust ... Set to yes as Rust is always enabled now.	7 years ago
Victor Julien	6fcd2db043	tile: remove files	8 years ago
Danny Browning	2dc6b6ee14	source-pcap-file: delete when done (2417) ... https://redmine.openinfosecfoundation.org/issues/2417 Add option to have pcap files deleted after they have been processed. This option combines well with pcap file continuous and streaming files to a directory being processed.	8 years ago
Jason Ish	fb85822730	dhcp: update user guide	8 years ago