35 Commits (5c419b79b7fd0c068b04e783f300ba4919c1b7f7)

Author	SHA1	Message	Date
Eric Leblond	da8b16eaeb	doc: add ip.dst and ip.src doc	2 years ago
Eric Leblond	f46f895e8d	rust/smb: import NT status code for Microsoft doc ... This patch updates the NT status code definition to use the status definition used on Microsoft documentation website. A first python script is building JSON object with code definition. ``` import json from bs4 import BeautifulSoup import requests ntstatus = requests.get('https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55') ntstatus_parsed = BeautifulSoup(ntstatus.text, 'html.parser') ntstatus_parsed = ntstatus_parsed.find('tbody') ntstatus_dict = {} for item in ntstatus_parsed.find_all('tr'): cell = item.find_all('td') if len(cell) == 0: continue code = cell[0].find_all('p') description_ps = cell[1].find_all('p') description_list = [] if len(description_ps): for desc in description_ps: if not desc.string is None: description_list.append(desc.string.replace('\n ', '')) else: description_list = ['Description not available'] if not code[0].string.lower() in ntstatus_dict: ntstatus_dict[code[0].string.lower()] = {"text": code[1].string, "desc": ' '.join(description_list)} print(json.dumps(ntstatus_dict)) ``` The second one is generating the code that is ready to be inserted into the source file: ``` import json ntstatus_file = open('ntstatus.json', 'r') ntstatus = json.loads(ntstatus_file.read()) declaration_format = 'pub const SMB_NT%s:%su32 = %s;\n' resolution_format = ' SMB_NT%s%s=> "%s",\n' declaration = "" resolution = "" text_max = len(max([ntstatus[x]['text'] for x in ntstatus.keys()], key=len)) for code in ntstatus.keys(): text = ntstatus[code]['text'] text_spaces = ' ' * (4 + text_max - len(text)) declaration += declaration_format % (text, text_spaces, code) resolution += resolution_format % (text, text_spaces, text) print(declaration) print('\n') print(''' pub fn smb_ntstatus_string(c: u32) -> String { match c { ''') print(resolution) print(''' _ => { return (c).to_string(); }, }.to_string() } ''') ``` Bug #5412.	2 years ago
Philippe Antoine	461725a9bf	dhcp: adds leasetime keyword ... As it is logged Ticket: #5435	3 years ago
Emmanuel Thompson	6641efb74f	doc/quic: Add documentation for QUIC keywords	3 years ago
Juliana Fajardini	4256c1ccd5	userguide: rename pg Lua Scripting->Lua Detection ... Since we can have scripts for output _or_ detection, it seems more clear to rename this page to add more meaning	3 years ago
Shivani Bhardwaj	51be8f0238	doc/dcerpc: add proto keywords	4 years ago
frank honza	ab59ef0d79	ikev1: add documentation for ikev1	4 years ago
Victor Julien	c95850c6ce	doc/rules: document config rule option	4 years ago
Philippe Antoine	999af4f62a	http2: adds documentation	5 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	5 years ago
Frank Honza	1c8943dedd	add RFB parser ... This commit adds support for the Remote Framebuffer Protocol (RFB) as used, for example, by various VNC implementations. It targets the official versions 3.3, 3.7 and 3.8 of the protocol and provides logging for the RFB handshake communication for now. Logged events include endpoint versions, details of the security (i.e. authentication) exchange as well as metadata about the image transfer parameters. Detection is enabled using keywords for: - rfb.name: Session name as sticky buffer - rfb.sectype: Security type, e.g. VNC-style challenge-response - rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ... The latter could be used, for example, to detect brute-force attempts on open VNC servers, while the name could be used to map unwanted VNC sessions to the desktop owners or machines. We also ship example EVE-JSON output and keyword docs as part of the Sphinx source for Suricata's RTD documentation.	5 years ago
Giuseppe Longo	dd5d0afd79	doc: add SIP keywords	6 years ago
Victor Julien	0107b9a057	doc/dataset: initial documentation	6 years ago
Vinjar Hillestad	4c18fee3c6	Documenting base64_decode and base64_content ... base64 doc changes based on #4027 pull feedback	6 years ago
Pierre Chifflier	aa608e0ca2	SNMP: add the "snmp.version" detection keyword	6 years ago
jason taylor	fc54d750dd	doc: add bypass keyword documentation ... Signed-off-by: jason taylor <jtfas90@gmail.com>	6 years ago
Victor Julien	72dd4a5f92	doc/rules: initial transforms documentation	6 years ago
Mats Klepsland	e92fda37c9	doc: add documentation for SSH keywords	6 years ago
Pierre Chifflier	0bd81ff838	Add krb5_msg_type detection keyword	7 years ago
Mats Klepsland	38cc6f595f	doc: add documentation for ja3_hash keyword	7 years ago
Eric Leblond	f5ba4c231d	doc: update following ftp-data changes	7 years ago
Ralph Broenink	98a1ec490f	doc: Move IP reputation keyword to rules section	7 years ago
Ralph Broenink	722cff1862	doc: Restructure ToC ... * All sections up to 2 levels deep are now shown regardless of whether they are a separate page * Rename Xbits and Thresholding for more consistent naming * Minor adjustment in the Payload Keywords section	7 years ago
Ralph Broenink	a55a6cdb62	doc: Move flowint as integral part of flow keywords	7 years ago
Ralph Broenink	bb1bf2643d	doc: Move fast_pattern and prefilter to dedicated page	7 years ago
Ralph Broenink	fea037fda8	doc: Moved explanation of normalized buffers to rules introduction	7 years ago
David Wharton	8a53d49e81	doc: replacing snort-compatibility link ... The snort-compatibility.rst document is being replaced by differences-from-snort.rst. This commit updates the link.	8 years ago
Victor Julien	bc38cd5932	doc: initial xbits documentation	8 years ago
Victor Julien	56ffba9fd8	doc: initial app-layer keywords ... Document app-layer-protocol and make a start with app-layer-event.	9 years ago
Victor Julien	d80914d350	doc: move rule reload and adding rules into rule-management	9 years ago
Victor Julien	92b393ee9a	doc: include enip page	9 years ago
Victor Julien	a2d8cfb5d3	doc: reorder rule docs	9 years ago
Victor Julien	5bd906ae9f	doc: prefilter keyword and config	9 years ago
Victor Julien	7ad667f282	doc: move snort compat to rule chapter	9 years ago
Jason Ish	2751baae46	doc: rename from "sphinx" to "userguide"	9 years ago