Commit Graph

572 Commits (6e5b7199cfd04ffbbfce4fa1244b80ed1ef61e2a)

Author SHA1 Message Date
Victor Julien 6e5b7199cf doc/smb: add resource limits section
(cherry picked from commit 976748b777)
4 years ago
Jeff Lucovsky 1306dbf268 doc/yaml: Signal-termination option description
(cherry picked from commit 93842aa14a)
4 years ago
Shivani Bhardwaj 0e9f42c744 doc/xbits: clarify noalert usage 5 years ago
Jeff Lucovsky 00ab84fd63 doc: Describe per-thread stack size config setting
Issue: 4550

This commit documents the new per-thread stack-size setting. Some
systems have a small default value that is not suitable for Suricata's
multi-threaded architecture and adjustment may be required.

(cherry picked from commit 117e11b0ae)
5 years ago
Shivani Bhardwaj 45745ed2ea doc: add usage of flowbits OR op
Ticket 5130

(cherry picked from commit 015c9fe1e3)
5 years ago
Odin Jenseg 89f453f7e7 doc/eve-json-format/dns: Describing Z-bit
(cherry picked from commit 2a5d79e426)
5 years ago
Juliana Fajardini 30b1e221ce doc/lua-functions: add sha items to SCFileInfo doc
(cherry picked from commit 751906b71d)
5 years ago
Philippe Antoine 590e917e94 http2: document HTTP1 keywords enabling
For HTTP signatures to match on HTTP2 traffic if configure
option app-layer.protocols.http2.http1-rules is enabled
5 years ago
Philippe Antoine b96f9c0dd5 doc: update sphinx api to use add_css_file
instead of deprecated add_stylesheet

(cherry picked from commit 95f225e8fb)
5 years ago
Jason Ish 029e3114b8 doc/quickstart: use new test url that works
Replace http://testmyids.org with http://testmynids.org/uid/index.html,
as testmyids.org now always redirects to https.

(cherry picked from commit 560974b2db)
6 years ago
Josh Stroschein 0eaa64aad5 doc: update installation documentation for CentOS and Fedora
(cherry picked from commit 7ece0ac31f)
6 years ago
Philippe Antoine eb2a5587fb http: makes decompression time limit configurable
(cherry picked from commit a04b5566a6)
6 years ago
Jeff Lucovsky 95df464ba8 doc/lua: Lua API name consistency
This commit updates the documentation of the SCFlow* function names
available to Lua scripts.

Formerly, they used the prefix "Sc"; now they use "SC".

(cherry picked from commit 25e9483168)
6 years ago
Victor Julien 0ad5a38fb4 ci: buildbot is decommissioned, so remove prscript refs
(cherry picked from commit 372fc26739)
6 years ago
Sascha Steinbiss 773545e6d9 doc: build all manpages
(cherry picked from commit f78f444a5e)
6 years ago
Kirby Kuehl 2a8571b3f4 doc: fix URL for unix-socket python example
(cherry picked from commit 5499a6f7cd)
6 years ago
Philippe Antoine 096dce4bba http2: allow filestore to work with HTTP2 6 years ago
Philippe Antoine 4e242645be doc: explicit header normalization further
And their concatenation as described in RFC 2616
6 years ago
Philippe Antoine 6b30890de9 doc: http.uri.raw has no spaces
as they are in the protocol

cf bug #2881
6 years ago
Victor Julien 7b4ac8dbab doc/userguide: update http keywords 6 years ago
Victor Julien ca47d75c80 doc/userguide: explain --strict-rule-keywords 6 years ago
Jeff Lucovsky a18a9d3046 doc: New sticky buffer icmpv4.hdr 6 years ago
Phil Young 76de981574 napatech: Added comment indicating that hba will be deprecated
HBA will be deprecated in Suricata 7
6 years ago
Jason Ish 3030a3da18 doc: provide eve 1 deprecation date 6 years ago
Victor Julien c95850c6ce doc/rules: document config rule option 6 years ago
Jeff Lucovsky 6f9b7e052a doc/eve: Update threaded filename examples 6 years ago
Jason Ish f70e1f571e doc/userguide: add info about --set and lists 6 years ago
Jason Ish 69fffb2dc4 doc/userguide: include man page even when not including pdf
Fix a mistake in Makefile.am where the man page was only being
added to the distribution if the PDF was also created. It should
be included even if the PDF cannot be included.
6 years ago
Shivani Bhardwaj 87617b200c doc/datasets: add info about memcap and hashsize 6 years ago
Jason Ish 7d44e80a50 doc: document removal of unified2
And suggest an alternate tool, Meer if compatibility with
Barnyard2 style databases is required.

Redmine ticket:
https://redmine.openinfosecfoundation.org/issues/3497
6 years ago
Jason Ish e71f2b22fa doc: add removal of individual json loggers
Add link to multiple eve instances as a replacement for this
feature.
6 years ago
Philippe Antoine 9b5c923327 http: disables lzma by default for HTTP 6 years ago
Victor Julien e1ecb7dc41 doc/datasets: explain reloads, general improvements 6 years ago
Simon Dugas 48da18b081 doc: dns - document additional fields in eve event
Documentation of additional fields for soa and sshfp. Also some minor
doc fixes and updates.
6 years ago
Jeff Lucovsky 06f41f608c doc: Improve grammar, spelling and clarifications
This commit improves the overall documentation's grammar, spelling, and
adds clarifications  where needed.
6 years ago
jason taylor b21160a6e3 doc: http.host keyword note for matching on port
Signed-off-by: jason taylor <jtfas90@gmail.com>
6 years ago
Roland Fischer de7c7eeff0 doc: Add dev code-style 6 years ago
Odin Jenseg 4549505418 doc/userguide: fix outdated xdp info 6 years ago
Philippe Antoine 999af4f62a http2: adds documentation 6 years ago
James Dutrisac 8d5e54c046 pcap: recusively reading pcaps / documentation
Changes to doc/userguide/partials/options.rst for feature 2363
   (reading pcaps recursively)
6 years ago
Sascha Steinbiss 4e1a41a17d output-json: add MAC address output
This commit adds MAC address output to the EVE-JSON format. We follow the
remarks made in Redmine ticket #962: for packets, log MAC src/dst as a
scalar field in EVE; for flows, log MAC src/dst as lists in EVE. Field names
are different between flow and packet context to avoid type confusion
(src_mac vs. src_macs). Configuration approach and JSON representation is
taken from previous GitHub PR #2700.
6 years ago
Sascha Steinbiss c31360070b rust/mqtt: add MQTT parser 6 years ago
Jeff Lucovsky a5d30a3220 doc/output: Document multithreaded eve option 6 years ago
Philippe Antoine 1569f3e349 transform: adds url_decode keyword
Fixes https://redmine.openinfosecfoundation.org/issues/2689

Adds a new source file to handle this keyword.
And modifies documentation, Makefile, and registration accordingly.

url_decode decodes url-encoded data, ie replacing '+' with space
and '%HH' with its value.
6 years ago
Victor Julien 00cc3c7374 eve/ssh: change hassh logging format
Elastic search didn't accept the 'hassh' and 'hassh.string'. It would
see the first 'hassh' as a string and split the second key into a
object 'hassh' with a string member 'string'. So two different types
for 'hassh', so it rejected it.

This patch mimics the ja3(s) logging by creating a 'hassh' object
with 2 members: 'hash', which holds the md5 representation, and
'string' which holds the string representation.
6 years ago
Tristan Fletcher 6cbb4d4909 doc: fix spelling in flowbits image 6 years ago
Victor Julien e04d48c8c8 doc/userguide: fix outdated mpm info 6 years ago
Victor Julien 04d88e7012 doc/suricata-update: fix typo and do minor cleanups
Thanks to showipintbri PR 4465.
6 years ago
Jeff Lucovsky 901fbae7b9 doc: Add byte_math documentation 6 years ago
Jeff Lucovsky 496306e6a9 doc: update stream-depth description 6 years ago