78 Commits (5a31b3508d6bec7df1a77e0422360c155a3de9f9)

Author	SHA1	Message	Date
Eric Leblond	6f06f7c22c	doc: add info about capture_file key	3 years ago
Jason Ish	6ceeb08351	doc/userguide: updates for eve dns v1 removal ... Ticket: #4157	3 years ago
Juliana Fajardini	579d7dcc01	pgsql: add initial support ... - add nom parsers for decoding most messages from StartupPhase and SimpleQuery subprotocols - add unittests - tests/fuzz: add pgsql to confyaml Feature: #4241	3 years ago
Emmanuel Thompson	9ad60e7661	doc/quic: Add quic to eve json format	3 years ago
Odin Jenseg	2a5d79e426	doc/eve-json-format/dns: Describing Z-bit	3 years ago
Juliana Fajardini	6b8b58f98a	doc/eve: common fields and alert updates ... - update examples for both - change app_proto from alert field to common field, as per JsonBuilder's changes.	4 years ago
Juliana Fajardini	eacf933edf	doc/eve: fix typos	4 years ago
Simon Dugas	0ed62e93ec	doc/modbus: add eve logging documentation	4 years ago
frank honza	f83d51d0cb	ike: set event for multiple server proposals	4 years ago
frank honza	ab59ef0d79	ikev1: add documentation for ikev1	4 years ago
Justin Ossevoort	320de5f43d	eve: Log tenant_id for all eve-json messages	4 years ago
Sascha Steinbiss	15c42e0d83	doc: add documentation for SRV DNS JSON structure	4 years ago
Jeff Lucovsky	6f9b7e052a	doc/eve: Update threaded filename examples	4 years ago
Jason Ish	7d44e80a50	doc: document removal of unified2 ... And suggest an alternate tool, Meer if compatibility with Barnyard2 style databases is required. Redmine ticket: https://redmine.openinfosecfoundation.org/issues/3497	5 years ago
Jason Ish	e71f2b22fa	doc: add removal of individual json loggers ... Add link to multiple eve instances as a replacement for this feature.	5 years ago
Simon Dugas	48da18b081	doc: dns - document additional fields in eve event ... Documentation of additional fields for soa and sshfp. Also some minor doc fixes and updates.	5 years ago
Philippe Antoine	999af4f62a	http2: adds documentation	5 years ago
Sascha Steinbiss	4e1a41a17d	output-json: add MAC address output ... This commit adds MAC address output to the EVE-JSON format. We follow the remarks made in Redmine ticket #962: for packets, log MAC src/dst as a scalar field in EVE; for flows, log MAC src/dst as lists in EVE. Field names are different between flow and packet context to avoid type confusion (src_mac vs. src_macs). Configuration approach and JSON representation is taken from previous GitHub PR #2700.	5 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	5 years ago
Jeff Lucovsky	a5d30a3220	doc/output: Document multithreaded eve option	5 years ago
Victor Julien	00cc3c7374	eve/ssh: change hassh logging format ... Elastic search didn't accept the 'hassh' and 'hassh.string'. It would see the first 'hassh' as a string and split the second key into a object 'hassh' with a string member 'string'. So two different types for 'hassh', so it rejected it. This patch mimics the ja3(s) logging by creating a 'hassh' object with 2 members: 'hash', which holds the md5 representation, and 'string' which holds the string representation.	5 years ago
Vadym Malakhatko	a80f705d4b	userguide: add documentation for Hassh usage ... 1. Rules keywords 2. Json keywords 3. Usage in lua 4. Enabling in configuration file	5 years ago
Frank Honza	1c8943dedd	add RFB parser ... This commit adds support for the Remote Framebuffer Protocol (RFB) as used, for example, by various VNC implementations. It targets the official versions 3.3, 3.7 and 3.8 of the protocol and provides logging for the RFB handshake communication for now. Logged events include endpoint versions, details of the security (i.e. authentication) exchange as well as metadata about the image transfer parameters. Detection is enabled using keywords for: - rfb.name: Session name as sticky buffer - rfb.sectype: Security type, e.g. VNC-style challenge-response - rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ... The latter could be used, for example, to detect brute-force attempts on open VNC servers, while the name could be used to map unwanted VNC sessions to the desktop owners or machines. We also ship example EVE-JSON output and keyword docs as part of the Sphinx source for Suricata's RTD documentation.	5 years ago
Victor Julien	411dd69e92	doc/eve: layout and formatting fixes	5 years ago
Jason Ish	718fcbb682	doc: document eve/dns v2 as the default ... Adds eve/dns v2 format documentation. Update legacy format to require the version field.	5 years ago
Jeff Lucovsky	17c3e22ecd	doc/eve.alert: Expand metadata description	5 years ago
Jason Ish	0cd5452194	doc: mark independent json loggers as deprecated ... This is the loggers such as alert-json-log, dns-json-log, etc. They are not even referenced in the default configuration file, and are easily replaced with multiple eve instances.	5 years ago
Jeff Lucovsky	44a59b78c7	doc/anomaly Remove event_no	5 years ago
Victor Julien	df325d63ea	doc/eve.anomaly: fix indent and general formatting	6 years ago
Jeff Lucovsky	075592b66f	doc: Simplified anomaly configuration settings	6 years ago
Jeff Lucovsky	aaacbf28c2	logging/anomaly: Support configuration filter types	6 years ago
Zach Kelly	caef8b5b38	protocol parser: rdp ... Initial implementation of feature 2314: 1. Add protocol parser for RDP 2. Add transactions for RDP negotiation 3. Add eve logging of transactions	6 years ago
Jeff Lucovsky	a66383569c	userguide: formatting: remove tabs	6 years ago
Jeff Lucovsky	c68510437f	userguide: ftp formatting updates	6 years ago
Jeff Lucovsky	2149807bd6	eve/ftp: Transaction support for unmatched requests ... Modified transaction logic to create a new transaction with each request; replies location transactions by using the oldest "open" (unmatched) transaction or the last transaction if none are open.	6 years ago
Jeff Lucovsky	1930b1f504	eve/ftp: Log FTP transactions ... This changeset includes changes that 1. Add transaction support to the FTP parser 2. Support eve json logging of FTP transactions	6 years ago
Jeff Lucovsky	6cd39c5cfb	userguide: Document app-layer anomaly items ... This changeset expands the anomaly section to include newly added app-layer items.	6 years ago
Eric Leblond	dbf3606169	doc: document flow event_type	6 years ago
Mats Klepsland	800608ab65	userguide: add JA3S fields to the TLS logger documentation	6 years ago
Jeff Lucovsky	8a94b93b7b	doc: Anomaly logging documentation ... This changeset adds discussion of anomaly log records and the anomaly log record format.	6 years ago
Pascal Delalande	bde65467a9	doc: add ssh protocol in eve log section	6 years ago
Victor Julien	c47164ebc8	doc: add table for custom values of eve/http	6 years ago
Maurizio Abba	6c0ec0b2f3	eve/http: add request/response http headers ... Add a keyword configuration dump-all-headers, with allowed values {both, request, response}, dumping all HTTP headers in the eve-log http object. Each header is a single object in the list request_headers (response_headers) with the following notation: { "name": <header name>, "value": <header value> } To avoid forged malicious headers, the header name size is capped at 256 bytes, the header value size at 2048. By default, dump-all-headers is disabled.	6 years ago
Victor Julien	473688746b	doc/eve: add community id	6 years ago
Maurizio Abba	bce7c2dd87	eve/http: add tx->request_port_number as http_port ... Add the port specified in the hostname (if any) to the http object in eve. The port may be different from the dest_port used by the TCP flow.	7 years ago
Pascal Delalande	4f48927c44	doc: spelling mistakes in various sections of the user guide	7 years ago
Pascal Delalande	e3c5784dd5	doc: minor updates (tls custom, TODO removal, ftp/smb file rules)	7 years ago
Victor Julien	83bf60d897	doc: add ntlmssp, kerberos and other setup fields	7 years ago
Victor Julien	e09027915a	doc: fix json formatting in smb doc	7 years ago
Victor Julien	67e81a9555	doc: initial smb eve documentation	7 years ago