244 Commits (5e2a33d08069cea8b4c2c7c2ff55973c0a258907)

Author	SHA1	Message	Date
Philippe Antoine	54c02e1301	stats: replace dashes by underscores in app-layer protocols ... Ticket: 6502 Forbid dashes in json keys for better use by processing tools	2 months ago
Philippe Antoine	d030ea7f29	output: rename reject-target to reject_target ... Ticket: 6502 Forbid dashes in json keys for better use by processing tools	2 months ago
Jason Ish	18f742fdbd	schema: map NTP fields to keywords	2 months ago
Jason Ish	713e4eb900	ntp: convert reference_id to buffer and add keyword ... Store the NTP reference ID as raw network-order bytes so it can be exposed as a sticky buffer and matched with payload keywords. The reference ID is often a 4 character string, or an IP address and not just an integer identifier. Updates the log reference ID to be a string of colon separated hex digits as this matches what tshark does. Ticket: #8488	3 months ago
Jason Ish	74bb525401	ntp: create tx for all modes; log version, mode and stratum ... Add logging for version, mode and stratum as these will be the first keywords we will add. Ticket: #8425	3 months ago
Jason Ish	31b967b089	ntp: add transaction logging ... Adds basic NTP transaction logging for the current supported message types. Includes small cleanups around reference ID. Ticket: #8425	3 months ago
Victor Julien	670fdabd32	detect/snmp: add snmp.trap_type keyword ... Implemented as a U8 integer keyword. Ticket: #8482.	3 months ago
Victor Julien	c94cb8e098	eve/schema: add snmp trap fields	3 months ago
Eric Leblond	e4e5413478	etc/schema: add http_request_body ... Ticket: 8161	3 months ago
Eric Leblond	97a0ad342b	etc/schema: match on http response body ... Matching on the HTTP response body is not really possible as it is a transformed version that can not be accessed via the signature language.	3 months ago
Jason Ish	3e9c726aa8	etc/schema: remove "optional" field ... The optional field has not been valid JSON schema field since we started using it, so remove it. All fields are optional unless marked as required.	4 months ago
Victor Julien	94c16d8915	eve/igmp: add schema support for alert records	4 months ago
Victor Julien	d652b7ef62	decoder/igmp: detect RGMP (RFC 3488) ... RGMP is a dialect of IGMP that uses the same protocol structure, but with some different values for the fields. Detect this and log it differently.	4 months ago
Victor Julien	1b7cc2b323	decoder/igmp: initial decoder support for IGMP ... Basic v1, v2 and v3 header validation. Ticket: #8262.	4 months ago
Philippe Antoine	0d714b9624	doc/jsonschema: remove non-existing email fields	5 months ago
Philippe Antoine	81cc007a11	doc/jsonschema: remove non-existent ldap field ... Probably a duplicate typo	5 months ago
Philippe Antoine	750ae52eac	doc/jsonschema: remove obsolete insert_list_fail field ... Ticket: 5267	5 months ago
Ofer Dagan	2371829bf1	schema: add threshold stats counters ... Add schema definitions for new threshold-related statistics: - bitmap_alloc_fail: Count of bitmap allocation failures - bitmap_memuse: Memory usage by detection_filter bitmaps - memcap: Memory cap for threshold hash table - memuse: Memory usage by threshold hash table Task #7928	6 months ago
Jeff Lucovsky	54bd8edf68	decode/ipv4: Create event on unknown protos ... Issue: 7146 Create an event when the IPv4 header contains an unknown IP protocol.	6 months ago
Philippe Antoine	dd6baccabd	src: doc: remove more double-space typos ... Found with git grep -E '[a-z] [a-z]'	6 months ago
Shivani Bhardwaj	0f92583702	flow: split elephant flow detection per dir ... The tracking for elephant flow is done per direction however, the flag was set on the flow whenever either of the directions crossed the rate-limit defined in the settings. Given that the tracking was already split, it makes sense to split the detection tracking per direction as well and allow user to have a better control via rule language.	7 months ago
Philippe Antoine	24405a7b76	doc: http fields in json schema ... Ticket: 6075	7 months ago
Philippe Antoine	2f39c8c099	jsonschema: remove obsolete http fields ... These were moved to array request_headers/response_headers Ticket: 6075	7 months ago
Philippe Antoine	cf88ed518c	jsonschema: check for duplicate keys ... Ticket: 6691 And fix the one duplicate found	7 months ago
Philippe Antoine	1df568300c	doc/jsonschema: use dnp3_func instead of its alias	8 months ago
Juliana Fajardini	331bc8aeac	schema: add descriptions to global memcaps/memuses ... For FTP, Host, IP Pair and HTTP. Related to Task #6434	8 months ago
Juliana Fajardini	2855574a2c	schema: add additional properties to stats.capture ... The `stats.capture` object may have different properties based on the capture method used. This adds the ones pertaining to AF_PACKET capture. Related to Task #6434	8 months ago
Juliana Fajardini	12e0e51864	schema: add desc for each main stats module ... Part of the schema documentation effort. Related to Task #6434	8 months ago
Juliana Fajardini	025ffa6135	schema: allow stats.stream event counters ... While the counters exist, they're not present in the schema, causing validation to fail if stats.stream-events is enabled. Task #7858	8 months ago
Juliana Fajardini	173fec81f8	schema/stats: flow_mgr is actually flow.mgr ... The schema accounts for a stats counters group that is a subgroup of the flows stats counters. Remove `flow_mgr`, thus.	8 months ago
Philippe Antoine	85fa894425	detect: dnp3.func is now a generic integer ... Ticket: 7889	8 months ago
Victor Julien	acb769291a	exception-policy: add 'reject-both' option ... Allow rejecting both sides of a connection. Has the same support as regular reject (which is essentially rejectsrc). Ticket: #5974.	8 months ago
Philippe Antoine	047f1c5080	doc: fix enip_command name in json schema ... enip.command is not a keyword nor an alias	9 months ago
Philippe Antoine	969739d067	detect: http2.errorcode is now a generic integer ... Ticket: 7889	9 months ago
Jason Ish	5e2dc9ace3	ike: don't log empty server objects	9 months ago
Jason Ish	2d86412f46	ike: log attributes as objects ... IKE attributes are an array of TLV style objects, this means there can be duplicate types seen on the wire. However, Suricata logs these as a mapping with the type as the key. This can result in the JSON containing duplicate keys. To address this, log the attributes as an array of objects, allow duplicates to exist, for example: "client": { "proposals": [ { "sa_life_duration": "Unknown", "sa_life_duration_raw": 86400, } } } is now logged as: "client": { "proposals": [ {"key": "sa_life_duration", "value": "Unknown", "raw": 86400} ] } Also adds `"version": 2` to each IKE record to note the change of format from previous versions. Ticket: #7902	9 months ago
Juliana Fajardini	426955782c	schema: add descriptions to capture stats counters ... Task #6434	9 months ago
Juliana Fajardini	3642594e14	schema: add descriptions to decoder stats counters ... Continuation of Task #7793	9 months ago
Juliana Fajardini	42d563f83e	schema: fix typos s/ERPSAN/ERSPAN	9 months ago
Philippe Antoine	4f7fc25a1a	detect/dnp3: make dnp3.ind a generic uint16 bitflags keyword ... Ticket: 6724 Allows operations such as negation	10 months ago
Fupeng Zhao	e79d735374	decode/etag: ETag 802.1BR decoder ... Ticket: #3953.	10 months ago
Philippe Antoine	dae9264120	doc: really enforce more the completeness of json schema ... Completes commit f1f32a39ee End better describe exception_policy	10 months ago
Philippe Antoine	2028a3f9f8	doc: complete json schema with integer keywords	10 months ago
Philippe Antoine	f1f32a39ee	doc: enforce more the completenes of json schema ... see jq 'paths( objects | (.type == "object" and (has("additionalProperties") | not) )) | join(".")' etc/schema.json fix and complete bittorrent on the way	10 months ago
Philippe Antoine	421fb8ac31	doc/ldap: complete json schema	10 months ago
Jeff Lucovsky	17e7387ff4	doc/fileinfo: Document fileinfo context/usage ... Issue: 6498	10 months ago
Juliana Fajardini	8f9f414866	schema: document stats.detect counters ... ... that were missing. Task #7795	10 months ago
Juliana Fajardini	051715a7eb	schema/description: capitalize initial letters ... For existing descriptions that weren't like that, yet.	11 months ago
Juliana Fajardini	1d27e268d1	schema: add descriptions for flow stats counters ... Task #7794	11 months ago
Juliana Fajardini	49629f7cb6	schema/decoder: add descriptions for stats counters ... Task #7793	11 months ago