Commit Graph

23 Commits (88d2f67a3b5cae367cb69c6aec3d9cb77e46dadd)

Author SHA1 Message Date
Shivani Bhardwaj 899eb38691 flowbits: deprecate toggle command
toggle command is not used by any major rulesets and increases the state
complexity of flowbits management. Also, all operations can be carried
out with the combination of other available commands. So, remove it.

Task 8595
2 months ago
Philippe Antoine e65643909a doc: move more examples to container:: example-rule
Ticket: 8372

And fix another bad rule
4 months ago
Shivani Bhardwaj 30bdaa44e1 doc: add elephant.flow usage section 8 months ago
Shivani Bhardwaj 06eafb79d6 detect/flow-pkts: check for both dir
The functionality of "both" can already be easily achieved by using both
"toclient" and "toserver" in a rule. This just adds the ease of
expression in rule. As it is added now, check the direction for the
pre-existing users of direction as well.
8 months ago
Juliana Fajardini d5810a42e1 userguide: document how suricata processes rules
Added a page that explains how rules are prioritized by Suri, as well
as what main different types of inspection happen and what elements are
involved when ordering rules.

Task #5449
11 months ago
Shivani Bhardwaj ad7ff1c91b flow/pkts: allow matching on either direction
For flow.bytes and flow.pkts keywords, allow matching in either
direction.

Feature 5646
2 years ago
Shivani Bhardwaj 52fd695e5a doc: update syntax for flow.pkts & flow.bytes 2 years ago
Juliana Fajardini 6e4a501e7c flowint: add isnotset support
Similar keywords use `isnotset`, while `flowint` only accepted `notset`
Opted to change the code, not only the regex, to keep the underlying
code also following the same patterns.

Task #7426
2 years ago
Juliana Fajardini 246acc7140 userguide: clarify flow:stateless explanation
While not incorrect, the previous wording made the sentence almost
paradoxical. While at it, also highlight a side effect that might not be
so clear to users.

Related to
Bug #6976
2 years ago
jason taylor aa919f8081 doc: update flowbits information
Ticket: #6991

Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Philippe Antoine b8bc2c7e0f doc: integer keywords
Ticket: 6628

Document the generic detection capabilities for integer keywords.
and make every integer keyword pointing to this section.
3 years ago
Philippe Antoine ab9b6e30b1 detect: adds flow integer keywords
Ticket: #6164

flow.pkts_toclient
flow.pkts_toserver
flow.bytes_toclient
flow.bytes_toserver
3 years ago
Philippe Antoine 390cf9248f detect: adds flow.age keyword
Ticket: #5536
4 years ago
Shivani Bhardwaj 015c9fe1e3 doc: add usage of flowbits OR op
Ticket 5130
5 years ago
Andreas Dolp b25350ee13 doc: Fix typo in documentation of rule keyword flow 5 years ago
Andreas Herz 30fd80b0ef doc: convert fancy quotes to straight quotes 7 years ago
Pascal Delalande f2dca46382 doc: fix minor typo 8 years ago
Victor Julien 5afeebf884 doc/flow: updates and cleanups to flow section 8 years ago
Ralph Broenink a55a6cdb62 doc: Move flowint as integral part of flow keywords 9 years ago
Ralph Broenink 3413793768 doc: Use lowercased keyword names as section titles 9 years ago
Jason Ish 1a724ba851 doc: flow: update and add new keywords 10 years ago
Andreas Herz 7806ae8f57 docs: sync up to recent redmine 10 years ago
Jason Ish 2751baae46 doc: rename from "sphinx" to "userguide" 10 years ago