Philippe Antoine
44b6aa5e4b
app-layer: websockets protocol support
...
Ticket: 2695
1 year ago
Sascha Steinbiss
120313f4da
ja4: implement for TLS and QUIC
...
Ticket: OISF#6379
1 year ago
Jeff Lucovsky
7a5a1e2560
doc: Describe noalert keyword
...
Issue: 6685
1 year ago
jason taylor
7de16809ef
doc: update http keyword listing order
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
8b3db3c3b5
doc: update file.name keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
49dba7bb94
doc: update file.data keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
bee3aa9709
doc: update http.response_header keyword
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
dcb548106e
doc: update http.request_header keyword
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
3f5d228b9e
doc: update http.host http.host.raw keyword
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
739dfe5e5e
doc: update http.location keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
9ddd8cf9e0
doc: update http.server keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
3af98f3b92
doc: update http.response_body keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
64760e2e75
doc: update http.response_line keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
566bc0d39c
doc: update http.stat_msg keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
271321249f
doc: update http.stat_code keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
71d8488cb5
doc: update http.request_body keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
c2783e9391
doc: update http.header_names keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
5eadbc2ff0
doc: update http.start keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
7e65554462
doc: update http.referer keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
876dfb99ca
doc: update http.content_len keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
8ff06c1bc0
doc: update http.content_type keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
b2854486dd
doc: update http.connection keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
75436dff9c
doc: update http.accept_lang keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
f6375e487e
doc: update http.accept_enc keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
7e3288f5a7
doc: update http keyword normalization notes
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
9e87d89d2e
doc: update http.accept keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
8307168ae7
doc: update http.user_agent keyword
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
75c4cdfa1c
doc: update http.cookie keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
7a28874c8d
doc: update http.header keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
b3af723486
doc: remove legacy description/duplicated data
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
292b3eb9b3
doc: update http.request_line keyword information
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
c7f351bd6e
doc: update http.protocol keyword documentation
...
Ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
2d0ceedeba
doc: update urilen keyword documentation
...
ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
ef118aa582
doc: remove legacy uricontent information
...
ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
96e8c10276
doc: update http.uri and http.uri.raw keywords
...
ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
bf192926a8
doc: update http.method keyword
...
ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
0cce5ba447
doc: add http keyword links
...
ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
fd46175203
doc: update http primer information
...
ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor
54fd35c5b4
doc: remove legacy tables and image references
...
ticket: 3025
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
Hadiqa Alamdar Bukhari
3aa313d0c5
dns: add dns.rcode keyword
...
dns.rcode matches the rcode header field in DNS messages
It's an unsigned integer
valid ranges = [0-15]
Does not support prefilter
Supports matches in both flow directions
Task #6621
1 year ago
Hadiqa Alamdar Bukhari
4b81851097
dns: add dns.rrtype keyword
...
It matches the rrtype field in DNS
It's an unsigned integer match
valid ranges = [0-65535]
Does not support prefilter
Supports flow in both directions
Feature #6666
1 year ago
Philippe Antoine
e22217bda8
doc: there is no right shift for integer bitmasks
...
Ticket: 6628
1 year ago
Philippe Antoine
f6e1a20215
detect: dns.opcode as first-class integer
...
Ticket: 5446
That means it can accept ranges
1 year ago
Juliana Fajardini
244a35d539
userguide: fix explanation about bsize ranges
...
Our code handles Uint ranges as exclusive, but for bsize, our
documentation stated that they're inclusive.
Cf. from uint.rs:
DetectUintMode::DetectUintModeRange => {
if val > x.arg1 && val < x.arg2 {
return true;
}
}
Task #6708
1 year ago
Philippe Antoine
b8bc2c7e0f
doc: integer keywords
...
Ticket: 6628
Document the generic detection capabilities for integer keywords.
and make every integer keyword pointing to this section.
1 year ago
Jason Ish
8bf8131c31
doc: note what version "requires" was added in
2 years ago
jason taylor
3cb7112aa5
detect: update smb.version keyword
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Eloy Pérez González
a4901a1f70
smb: add smb.keyword documentation
2 years ago
Lukas Sismis
6e4cc79b39
doc: remove references to prehistoric versions
...
Remove references that are mentioning Suricata 3 or less
As a note - only one Suricata 4 reference found:
(suricata-yaml.rst:"In 4.1.x")
Fast pattern selection criteria can be internally found by inspecting
SupportFastPatternForSigMatchList and SigTableSetup functions.
Ticket: #6570
2 years ago
Philippe Antoine
adf5e6da7b
detect: strip_pseudo_headers transform
...
Ticket: 6546
2 years ago