Victor Julien
6e5b7199cf
doc/smb: add resource limits section
...
(cherry picked from commit 976748b777 )
4 years ago
Jeff Lucovsky
1306dbf268
doc/yaml: Signal-termination option description
...
(cherry picked from commit 93842aa14a )
4 years ago
Shivani Bhardwaj
0e9f42c744
doc/xbits: clarify noalert usage
5 years ago
Jeff Lucovsky
00ab84fd63
doc: Describe per-thread stack size config setting
...
Issue: 4550
This commit documents the new per-thread stack-size setting. Some
systems have a small default value that is not suitable for Suricata's
multi-threaded architecture and adjustment may be required.
(cherry picked from commit 117e11b0ae )
5 years ago
Shivani Bhardwaj
45745ed2ea
doc: add usage of flowbits OR op
...
Ticket 5130
(cherry picked from commit 015c9fe1e3 )
5 years ago
Odin Jenseg
89f453f7e7
doc/eve-json-format/dns: Describing Z-bit
...
(cherry picked from commit 2a5d79e426 )
5 years ago
Juliana Fajardini
30b1e221ce
doc/lua-functions: add sha items to SCFileInfo doc
...
(cherry picked from commit 751906b71d )
5 years ago
Philippe Antoine
590e917e94
http2: document HTTP1 keywords enabling
...
For HTTP signatures to match on HTTP2 traffic if configure
option app-layer.protocols.http2.http1-rules is enabled
5 years ago
Philippe Antoine
b96f9c0dd5
doc: update sphinx api to use add_css_file
...
instead of deprecated add_stylesheet
(cherry picked from commit 95f225e8fb )
5 years ago
Jason Ish
029e3114b8
doc/quickstart: use new test url that works
...
Replace http://testmyids.org with http://testmynids.org/uid/index.html ,
as testmyids.org now always redirects to https.
(cherry picked from commit 560974b2db )
6 years ago
Josh Stroschein
0eaa64aad5
doc: update installation documentation for CentOS and Fedora
...
(cherry picked from commit 7ece0ac31f )
6 years ago
Philippe Antoine
eb2a5587fb
http: makes decompression time limit configurable
...
(cherry picked from commit a04b5566a6 )
6 years ago
Jeff Lucovsky
95df464ba8
doc/lua: Lua API name consistency
...
This commit updates the documentation of the SCFlow* function names
available to Lua scripts.
Formerly, they used the prefix "Sc"; now they use "SC".
(cherry picked from commit 25e9483168 )
6 years ago
Victor Julien
0ad5a38fb4
ci: buildbot is decommissioned, so remove prscript refs
...
(cherry picked from commit 372fc26739 )
6 years ago
Sascha Steinbiss
773545e6d9
doc: build all manpages
...
(cherry picked from commit f78f444a5e )
6 years ago
Kirby Kuehl
2a8571b3f4
doc: fix URL for unix-socket python example
...
(cherry picked from commit 5499a6f7cd )
6 years ago
Philippe Antoine
096dce4bba
http2: allow filestore to work with HTTP2
6 years ago
Philippe Antoine
4e242645be
doc: explicit header normalization further
...
And their concatenation as described in RFC 2616
6 years ago
Philippe Antoine
6b30890de9
doc: http.uri.raw has no spaces
...
as they are in the protocol
cf bug #2881
6 years ago
Victor Julien
7b4ac8dbab
doc/userguide: update http keywords
6 years ago
Victor Julien
ca47d75c80
doc/userguide: explain --strict-rule-keywords
6 years ago
Jeff Lucovsky
a18a9d3046
doc: New sticky buffer icmpv4.hdr
6 years ago
Phil Young
76de981574
napatech: Added comment indicating that hba will be deprecated
...
HBA will be deprecated in Suricata 7
6 years ago
Jason Ish
3030a3da18
doc: provide eve 1 deprecation date
6 years ago
Victor Julien
c95850c6ce
doc/rules: document config rule option
6 years ago
Jeff Lucovsky
6f9b7e052a
doc/eve: Update threaded filename examples
6 years ago
Jason Ish
f70e1f571e
doc/userguide: add info about --set and lists
6 years ago
Jason Ish
69fffb2dc4
doc/userguide: include man page even when not including pdf
...
Fix a mistake in Makefile.am where the man page was only being
added to the distribution if the PDF was also created. It should
be included even if the PDF cannot be included.
6 years ago
Shivani Bhardwaj
87617b200c
doc/datasets: add info about memcap and hashsize
6 years ago
Jason Ish
7d44e80a50
doc: document removal of unified2
...
And suggest an alternate tool, Meer if compatibility with
Barnyard2 style databases is required.
Redmine ticket:
https://redmine.openinfosecfoundation.org/issues/3497
6 years ago
Jason Ish
e71f2b22fa
doc: add removal of individual json loggers
...
Add link to multiple eve instances as a replacement for this
feature.
6 years ago
Philippe Antoine
9b5c923327
http: disables lzma by default for HTTP
6 years ago
Victor Julien
e1ecb7dc41
doc/datasets: explain reloads, general improvements
6 years ago
Simon Dugas
48da18b081
doc: dns - document additional fields in eve event
...
Documentation of additional fields for soa and sshfp. Also some minor
doc fixes and updates.
6 years ago
Jeff Lucovsky
06f41f608c
doc: Improve grammar, spelling and clarifications
...
This commit improves the overall documentation's grammar, spelling, and
adds clarifications where needed.
6 years ago
jason taylor
b21160a6e3
doc: http.host keyword note for matching on port
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
6 years ago
Roland Fischer
de7c7eeff0
doc: Add dev code-style
6 years ago
Odin Jenseg
4549505418
doc/userguide: fix outdated xdp info
6 years ago
Philippe Antoine
999af4f62a
http2: adds documentation
6 years ago
James Dutrisac
8d5e54c046
pcap: recusively reading pcaps / documentation
...
Changes to doc/userguide/partials/options.rst for feature 2363
(reading pcaps recursively)
6 years ago
Sascha Steinbiss
4e1a41a17d
output-json: add MAC address output
...
This commit adds MAC address output to the EVE-JSON format. We follow the
remarks made in Redmine ticket #962 : for packets, log MAC src/dst as a
scalar field in EVE; for flows, log MAC src/dst as lists in EVE. Field names
are different between flow and packet context to avoid type confusion
(src_mac vs. src_macs). Configuration approach and JSON representation is
taken from previous GitHub PR #2700 .
6 years ago
Sascha Steinbiss
c31360070b
rust/mqtt: add MQTT parser
6 years ago
Jeff Lucovsky
a5d30a3220
doc/output: Document multithreaded eve option
6 years ago
Philippe Antoine
1569f3e349
transform: adds url_decode keyword
...
Fixes https://redmine.openinfosecfoundation.org/issues/2689
Adds a new source file to handle this keyword.
And modifies documentation, Makefile, and registration accordingly.
url_decode decodes url-encoded data, ie replacing '+' with space
and '%HH' with its value.
6 years ago
Victor Julien
00cc3c7374
eve/ssh: change hassh logging format
...
Elastic search didn't accept the 'hassh' and 'hassh.string'. It would
see the first 'hassh' as a string and split the second key into a
object 'hassh' with a string member 'string'. So two different types
for 'hassh', so it rejected it.
This patch mimics the ja3(s) logging by creating a 'hassh' object
with 2 members: 'hash', which holds the md5 representation, and
'string' which holds the string representation.
6 years ago
Tristan Fletcher
6cbb4d4909
doc: fix spelling in flowbits image
6 years ago
Victor Julien
e04d48c8c8
doc/userguide: fix outdated mpm info
6 years ago
Victor Julien
04d88e7012
doc/suricata-update: fix typo and do minor cleanups
...
Thanks to showipintbri PR 4465.
6 years ago
Jeff Lucovsky
901fbae7b9
doc: Add byte_math documentation
6 years ago
Jeff Lucovsky
496306e6a9
doc: update stream-depth description
6 years ago