79 Commits (9fc1250ca8c3a07d4819a274a843a230954a0ac4)

Author	SHA1	Message	Date
Pierre Chifflier	c51ff32adb	Document Kerberos 5 parsing events	7 years ago
Pierre Chifflier	1076c7cd47	Add krb5_err_code detection keyword	7 years ago
Pierre Chifflier	d6b9c0294a	Add krb5_cname and krb5_sname detection keywords	7 years ago
Pierre Chifflier	0bd81ff838	Add krb5_msg_type detection keyword	7 years ago
Pierre Chifflier	1e5f5d405f	Kerberos 5: add support for TCP as well	7 years ago
Pascal Delalande	4f48927c44	doc: spelling mistakes in various sections of the user guide	7 years ago
Eric Leblond	0c4bf2d332	doc: add a lua support top level section ... Both output and signature are using lua. So lua functions should be displayed in a single section.	7 years ago
Pascal Delalande	e3c5784dd5	doc: minor updates (tls custom, TODO removal, ftp/smb file rules)	7 years ago
Victor Julien	ccde621ceb	doc: add suricata-update to intro for rules	7 years ago
Pierre Chifflier	6eb48e1e93	Add ikev2 to userguide	7 years ago
Victor Julien	26e807ca34	doc: fix http_header_names example	7 years ago
Mats Klepsland	a357f52fa5	doc: add documentation for ja3_string keyword	7 years ago
Mats Klepsland	38cc6f595f	doc: add documentation for ja3_hash keyword	7 years ago
David DIALLO	c2236ea2b3	modbus: Support Unit Identifier ... When destination IP address does not suffice to uniquely identify the Modbus/TCP device. Some Modbus/TCP devices act as gateways to other Modbus/TCP devices that are behind this gateways.	7 years ago
Andreas Herz	2e8678a5ff	docs: replace redmine links and enforce https on oisf urls	7 years ago
David DIALLO	6c643d8975	modbus: duplicate alerts unaware of direction ... Remove DetectAppLayerInspectEngineRegister for TOCLIENT direction because Modbus inspection engine is only performing in request (TOSERVER). Detect Value keyword in read access rule. In read access, match on value is not possible. Update Modbus keyword documentation.	7 years ago
Giuseppe Longo	d2121945c9	doc: update file_data description	7 years ago
Eric Leblond	72c8cd67d5	doc: documentation update on metadata	7 years ago
Pascal Delalande	0ff60f65ec	doc: update filestore for file hash extraction ... Update for extraction based on md5, sha1 and sha256	7 years ago
Victor Julien	07738af868	detect/content: introduce startswith modifier ... Add startswith modifier to simplify matching patterns at the start of a buffer. Instead of: content:"abc"; depth:3; This enables: content:"abc"; startswith; Especially with longer patterns this makes the intention of the rule more clear and eases writing the rules. Internally it's simply a shorthand for 'depth:<pattern len>;'. Ticket https://redmine.openinfosecfoundation.org/issues/742	7 years ago
Eric Leblond	f5ba4c231d	doc: update following ftp-data changes	7 years ago
Andreas Herz	6f0794c16f	keyword-filesize: add units	7 years ago
Ralph Broenink	f6938933d9	doc: Amend the list of accepted protocols ... Based on the list in suricata.yaml	7 years ago
Ralph Broenink	98a1ec490f	doc: Move IP reputation keyword to rules section	7 years ago
Ralph Broenink	722cff1862	doc: Restructure ToC ... * All sections up to 2 levels deep are now shown regardless of whether they are a separate page * Rename Xbits and Thresholding for more consistent naming * Minor adjustment in the Payload Keywords section	7 years ago
Ralph Broenink	196ba1da70	doc: Make the header keywords section separate sections in ToC	7 years ago
Ralph Broenink	a55a6cdb62	doc: Move flowint as integral part of flow keywords	7 years ago
Ralph Broenink	f6c766112c	doc: Minor changes in structuring of HTTP Keywords / Snort differences	7 years ago
Ralph Broenink	e9b25988ba	doc: Move pcre entirely to Payload Keywords section ... (plus remove lingering screenshot of a rule)	7 years ago
Ralph Broenink	bb1bf2643d	doc: Move fast_pattern and prefilter to dedicated page	7 years ago
Ralph Broenink	fea037fda8	doc: Moved explanation of normalized buffers to rules introduction	7 years ago
Ralph Broenink	11990c7117	doc: Move the definition of modifier keywords to the introduction	7 years ago
Ralph Broenink	dfae19247d	doc: Completely rewrite the rules introduction for more clearity	7 years ago
Ralph Broenink	274c36eb2f	doc: Meta-settings -> Meta Keywords plus some textual changes ... Most importantly, conventions are now placed in tip boxes	7 years ago
Ralph Broenink	3413793768	doc: Use lowercased keyword names as section titles	7 years ago
Ralph Broenink	a52aacb4ea	doc: Replace images of tables and rules with text in rules docs ... In some chapters of the rules documentation, many sections used examples of rules, but these were inserted into images. These have been replaced by text and HTML emphasis. Additionally, some tables embedded into images were also replaced by reST tables.	7 years ago
Mats Klepsland	9556d4fef3	doc: add documentation for tls_cert_fingerprint keyword	7 years ago
Victor Julien	1180687574	doc/file_data: add note on negated matching ... Explain issue #2216 and how to avoid it.	8 years ago
Abbed	320b032a88	doc: small typo under '4.3.1.5' section	8 years ago
Eric Leblond	f5ad6a2095	doc: document target keyword	8 years ago
Andreas Herz	bf1a8d08da	doc: rephrase nocase placement explanation	8 years ago
Victor Julien	4697330b73	doc: flowints formatting cleanup	8 years ago
Victor Julien	0af562d4c8	doc: move parts out of snort difference doc ... Move generic keyword descriptions to the keyword documentation.	8 years ago
David Wharton	a8d0ae460c	doc: removing (replaced) snort-compatibility.rst ... snort-compatibility.rst replaced by differences-from-snort.rst	8 years ago
David Wharton	8a53d49e81	doc: replacing snort-compatibility link ... The snort-compatibility.rst document is being replaced by differences-from-snort.rst. This commit updates the link.	8 years ago
David Wharton	6bc7c64794	doc: overhaul of the snort-compatibility document ... This is intended to replace the existing 'snort-compatibility.rst' document. Based on "The Suricata Rule Writing Guide for The Snort Expert" 2016 SuriCon talk.	8 years ago
Victor Julien	245a89b7e7	doc: http keywords update	8 years ago
Mats Klepsland	ee9f822b8e	doc: add documentation for tls_cert_serial keyword	8 years ago
David Wharton	1bf7ded224	doc: specify buffers that can be used for fast_pattern ... Updated notes on the following buffers indicating that they can be used for fast_pattern: tls_cert_subject tls_cert_issuer tls_sni	8 years ago
David Wharton	b1ad770b36	doc: removed references to older Suricata versions ... docs are versioned; references to older Suricata versions undesired.	8 years ago