suricata

Commit Graph

Author	SHA1	Message	Date
Lukas Sismis	da64eace18	util/log: rotate calendar intervals on local-time boundaries With rotate-interval set to minute, hour or day, rotations were not aligned to the local time boundaries. The first rotation was computed by SCGetSecondsUntil(), which overshoots the next hour by one minute (hh:01:00) and the next day by one hour and one minute (01:01:00). Every following rotation was re-armed with a fixed interval (e.g. 86400 s) from the time of the rotation. Local days are not always 86400 s long, so the day rotation also moved by the DST shift on every DST transition and stayed there until the next one. A file named after a date then held events of the next day. Instead, this commit rotates logs when the local minute, hour or date changes. The daily rotation now happens at local midnight. On SIGHUP, the period is recorded before the file is reopened, so a boundary (the next minute/hour/day) passing during the reopen leads to an extra reopen instead of a missed rotation. Ticket: #9139	6 days ago
Jeff Lucovsky	e7dc0d885b	doc/config: Update flushing description Update output flushing description to reflect EVE based approach in documentation and config template. Issue: 8286	7 months ago
Jeff Lucovsky	5a3a2d5fd1	doc/output: Document the IPv6 display behavior Issue: 7399 Document the IPv6 display behavior and how to display IPv6 addresses in their compressed form (per RFC-5952).	8 months ago
Fupeng Zhao	f7ec1c8813	redis: Add authentication support Add authentication support to the Redis logging output. It introduces `username` and `password` configuration options for Redis, allowing Suricata to authenticate with Redis servers that require it. Ticket: 7062	9 months ago
Jeff Lucovsky	c0d54d838e	gen/typo: Misc. typo fixes	1 year ago
Jeff Lucovsky	97b03b4076	doc/netflow: Discuss netflow Add discussion for netflow configuration, event type and fields contained in netflow records. Issue: 5139	1 year ago
Philippe Antoine	706a0bd99b	output: option to add suricata version in eve logs Ticket: 4853	2 years ago
Joyce Yu	dac0d6371e	Doc: update eve-json-output ethernet description Document getting mac addresses from flow when flow timeout.	2 years ago
Jeff Lucovsky	a3a3ad8968	doc/output: EVE output buffering related settings	2 years ago
Philippe Antoine	a499529477	doc: improve documentation about guess-applayer-tx Ticket: 7199	2 years ago
Philippe Antoine	f2c3776314	detect: log app-layer metadata in alert with single tx Ticket: 7199 Uses a config parameter detect.guess-applayer-tx to enable this behavior (off by default) This feature is requested for use cases with signatures not using app-layer keywords but still targetting application layer transactions, such as pass/drop rule combination, or lua usage. This overrides the previous behavior of checking if the signature has a content match, by checking if there is only one live transaction, in addition to the config parameter being set.	2 years ago
Sascha Steinbiss	285cc29ec0	redis: add automatic trimming support for streams	2 years ago
Sascha Steinbiss	d3d9f1c395	redis: implement XADD stream support Ticket: #7082	2 years ago
Juliana Fajardini	55b922ceed	tls/conf: clarify usage of custom vs extended logs Since enabling custom logging will replace the extended logging, thus possibly leading to certain fields disappearing from the logs, mention this aspect. Related to Bug #7333	2 years ago
Jeff Lucovsky	8064847fc6	doc: Document reference config setting Issue: 4974	2 years ago
Philippe Antoine	e0fd59a20d	doc: state that payload-length includes the gaps	2 years ago
Jason Ish	4d3d57249a	doc: update dns section of the eve format documentation	2 years ago
Sascha Steinbiss	53c62432c6	doc: update MQTT configuration	2 years ago
Philippe Antoine	c9ce43b31e	output: configurable payload_length field for alerts Ticket: 7098	2 years ago
Giuseppe Longo	8a171c9d74	doc: add arp changes	2 years ago
Juliana Fajardini	bb59124063	yaml: unify 0 stats counter config option terms When we added feature #5976 (`72146b969`), we overlook that we also have a config stats option for the human-readable stats logs to output 0 counters. Due to not seeing this before, we now have two different setting names for basically the same thing, but in different logs: - zero-valued-counters for EVE - null-values for stats.log This ensures we use the same terminology, and change the recently added one to `null-values`, as this one has been around for longer. Task #6962	3 years ago
Sascha Steinbiss	120313f4da	ja4: implement for TLS and QUIC Ticket: OISF#6379	3 years ago
Juliana Fajardini	72146b969c	eve/stats: allow hiding counters whose valued is 0 Some stats can be quite verbose if logging all zero valued-counters. This allows users to disable logging such counters. Default is still true, as that's the expected behavior for the engine. Task #5976	3 years ago
Juliana Fajardini	58fb559594	userguide: document flow_id, with examples Flow_id explanation expanded from version shared by Peter Manev. Task #6445	3 years ago
Juliana Fajardini	0437173848	output/drop: add verdict field Related to Bug #5464	3 years ago
Philippe Antoine	9287cbc33a	http: logs custom headers in a subobject This subobject is request_headers or response_headers This especially avoids json keys collisions. Ticket: #5320 Also fixes typo referrer/referer	3 years ago
Victor Julien	c0d9b3c078	doc/userguide: spelling	4 years ago
Lukas Sismis	e101384e7b	transversal: remove suricata-ids.org references	4 years ago
Jason Ish	6ceeb08351	doc/userguide: updates for eve dns v1 removal Ticket: #4157	5 years ago
Justin Ossevoort	320de5f43d	eve: Log tenant_id for all eve-json messages	6 years ago
Jeff Lucovsky	6f9b7e052a	doc/eve: Update threaded filename examples	6 years ago
Jason Ish	e71f2b22fa	doc: add removal of individual json loggers Add link to multiple eve instances as a replacement for this feature.	6 years ago
Sascha Steinbiss	4e1a41a17d	output-json: add MAC address output This commit adds MAC address output to the EVE-JSON format. We follow the remarks made in Redmine ticket #962: for packets, log MAC src/dst as a scalar field in EVE; for flows, log MAC src/dst as lists in EVE. Field names are different between flow and packet context to avoid type confusion (src_mac vs. src_macs). Configuration approach and JSON representation is taken from previous GitHub PR #2700.	6 years ago
Jeff Lucovsky	a5d30a3220	doc/output: Document multithreaded eve option	6 years ago
Jason Ish	718fcbb682	doc: document eve/dns v2 as the default Adds eve/dns v2 format documentation. Update legacy format to require the version field.	7 years ago
Jeff Lucovsky	17c3e22ecd	doc/eve.alert: Expand metadata description	7 years ago
Jason Ish	0cd5452194	doc: mark independent json loggers as deprecated This is the loggers such as alert-json-log, dns-json-log, etc. They are not even referenced in the default configuration file, and are easily replaced with multiple eve instances.	7 years ago
Victor Julien	df325d63ea	doc/eve.anomaly: fix indent and general formatting	7 years ago
Jeff Lucovsky	075592b66f	doc: Simplified anomaly configuration settings	7 years ago
Jeff Lucovsky	aaacbf28c2	logging/anomaly: Support configuration filter types	7 years ago
Mats Klepsland	800608ab65	userguide: add JA3S fields to the TLS logger documentation	8 years ago
Jeff Lucovsky	8a94b93b7b	doc: Anomaly logging documentation This changeset adds discussion of anomaly log records and the anomaly log record format.	8 years ago
Victor Julien	c47164ebc8	doc: add table for custom values of eve/http	8 years ago
Victor Julien	473688746b	doc/eve: add community id	8 years ago
Pascal Delalande	4f48927c44	doc: spelling mistakes in various sections of the user guide	9 years ago
Mats Klepsland	47a7ebbbc2	doc: add JA3 fields to the TLS logger documentation	9 years ago
Jason Ish	74e036d09f	doc: update eve/alert/metadata configuration	9 years ago
Martin Natano	fe9cac5870	eve/alert: include rule text in alert output For SIEM analysis it is often useful to refer to the actual rules to find out why a specific alert has been triggered when the signature message does not convey enough information. Turn on the new rule flag to include the rule text in eve alert output. The feature is turned off by default. With a rule like this: alert dns $HOME_NET any -> 8.8.8.8 any (msg:"Google DNS server contacted"; sid:42;) The eve alert output might look something like this (pretty-printed for readability): { "timestamp": "2017-08-14T12:35:05.830812+0200", "flow_id": 1919856770919772, "in_iface": "eth0", "event_type": "alert", "src_ip": "10.20.30.40", "src_port": 50968, "dest_ip": "8.8.8.8", "dest_port": 53, "proto": "UDP", "alert": { "action": "allowed", "gid": 1, "signature_id": 42, "rev": 0, "signature": "Google DNS server contacted", "category": "", "severity": 3, "rule": "alert dns $HOME_NET any -> 8.8.8.8 any (msg:\"Google DNS server contacted\"; sid:43;)" }, "app_proto": "dns", "flow": { "pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 81, "bytes_toclient": 0, "start": "2017-08-14T12:35:05.830812+0200" } } Feature #2020	9 years ago
Eric Leblond	72c8cd67d5	doc: documentation update on metadata	9 years ago
Jason Ish	ab939f4aaa	doc: breakout eve-log section to a partial file Both the suricata.yaml and eve configuration sections included the eve-log section from suricata.yaml. First, sync these up with the actual suricata.yaml then break it out into its own file, so only one file needs to be kept in sync with the actual configuration file.	9 years ago

1 2

64 Commits (5b1f50ef0de09c11fb9ba513eb47386911f33521)