Jeff Lucovsky
a0af50f188
doc/entropy: Describe unique names conf var
...
Discuss the new configuration variable that provides unique
names for entropy values in logging output: logging.entropy.make-unique
Issue: 7814
12 months ago
Philippe Antoine
af8390f2ca
doc: upgrade note for engine-analysis breaking change
...
For keywords that now use the generic integer framework
Ticket: 7889
12 months ago
Philippe Antoine
d94aea8331
detect: tcp.window is now a generic integer
...
Ticket: 7889
12 months ago
Philippe Antoine
68bb783e97
detect: tcp.seq is now a generic integer
...
Ticket: 7889
12 months ago
Philippe Antoine
ed907bbd78
detect: tcp.ack is now a generic integer
...
Ticket: 7889
12 months ago
Philippe Antoine
7a8eb28cae
detect: id is now a generic integer
...
Ticket: 7889
12 months ago
Philippe Antoine
bff7413488
detect: icmp_seq is now a generic integer
...
Ticket: 7889
12 months ago
Philippe Antoine
79e66f76e6
detect: icmp_id is now a generic integer
...
Ticket: 7889
12 months ago
Philippe Antoine
09531447d1
detect: fragoffset is now a generic integer
...
Ticket: 7889
12 months ago
Philippe Antoine
85fa894425
detect: dnp3.func is now a generic integer
...
Ticket: 7889
12 months ago
Jeff Lucovsky
b02d9bb4f1
doc/luaxform: Remove init function from example
...
Issue: 8035
The `luaxform` transform doesn't support the `init` function. This
commit removes that from the example and clarifies how functions in the
Lua script are used.
12 months ago
Victor Julien
558ab73a7f
doc/devguide: explain alert logging changes
12 months ago
Philippe Antoine
c61f1cb6d0
detect/integers: rename index all1 to all
...
And all to all_or_absent
Ticket: 7929
12 months ago
Victor Julien
ec65fd430e
exception-policy: rename 'reject-both' to 'rejectboth'
...
To align it with the rule action.
12 months ago
Jason Ish
cdd4ea0f11
doc/devguide: document eve callback
...
Document the callback for adding additional data to EVE.
Ticket: #4708
1 year ago
Jason Ish
9fffc09ad7
doc/devguide: document eve file types
...
Ticket: #4708
1 year ago
Victor Julien
0c4a8fd183
doc/userguide: document reject-both expection policy
...
Ticket: #5974 .
1 year ago
David Wharton
9d2d1c4f8f
doc: minor verbiage tweaks and reST fix
1 year ago
Philippe Antoine
d8cb00e795
detect/tcp: make tcp.flags a generic integer with bitflags
...
Ticket: 6724
Allows to use numerical values for example
Also fixes some unit tests that were returning 1 after goto error
FlagsTestParse05 especially took this path as
de->ignored_flags != (TH_SYN|TH_RST) was false
we had de->ignored_flags == 0xff ^ (TH_SYN|TH_RST)
And then, we had a match, instead of what the not-run code
was supposing.
1 year ago
Philippe Antoine
1f9236a6d8
detect/ipv4: make fragbits a generic uint16 bitflags keyword
...
Ticket: 6724
Allows to use numerical values
1 year ago
Philippe Antoine
633180c93f
detect/integers: generalize support for bitflags modifier
...
Ticket: 6724
Allows sugar syntax for bitflags keywords.
While the expressivity does not increase, because we could already
use numerial values with all generic integer modes, this modifier
prefix is used with the strings, and follows the syntax
that is already used for fragbits and tcp.flags keyword.
1 year ago
Philippe Antoine
4b69a31dc3
detect/integers: count argument for multi-integers
...
Ticket: 7211
Allows to count the number of elements, without matching on
individual elements
1 year ago
Philippe Antoine
969739d067
detect: http2.errorcode is now a generic integer
...
Ticket: 7889
1 year ago
Philippe Antoine
401b2fcae6
detect: http2.frametype is now a generic integer
...
Ticket: 7889
1 year ago
Jeff Lucovsky
16d124cfda
doc/output: Highlight ethertype value change
...
Issue: 7855
Highlight the change to how ether_type values are displayed. Previously,
they were displayed in network order as a decimal value.
They are now displayed in host order as a decimal value.
1 year ago
Juliana Fajardini
ff96c52541
doc/install: fix minor typo
1 year ago
Juliana Fajardini
a3bd4ec324
doc: remove outdated GITGUIDE
1 year ago
Jason Ish
ced0c2c466
doc: upgrade notes for changes to ike output
1 year ago
Victor Julien
48972d544c
doc/userguide: link to protocol details from transactional rules
1 year ago
Victor Julien
480e664b4c
doc/userguide: add xbits tx scope support
...
Ticket #7680 .
1 year ago
Victor Julien
a1c4167d94
doc/userguide: add initial protocols overview
...
Explain per protocol mechanics for rule matching.
1 year ago
Victor Julien
7034a17d1d
doc/devguide: remove WIP mention of files in txs
...
Work has been completed, so comment is no longer accurate.
1 year ago
Victor Julien
e2a5bc058c
doc/userguide: fix DCERPC headings
1 year ago
Victor Julien
be5c83ed53
doc/userguide: add rule hooks to protocol doc
...
Ticket #7662 .
1 year ago
Victor Julien
91f258e2bc
doc/userguide: add missing app-layer protocols
1 year ago
Victor Julien
2623e67a80
doc/userguide: add missing rule protocols
1 year ago
Philippe Antoine
3641b4eda1
detect/nfs: move nfs_procedure to rust
...
Make it able to use strings on the way
Ticket: 6723
1 year ago
Philippe Antoine
9869fb776b
detect/snmp: pdu_type keyword now accepts strings
...
Ticket: 6723
1 year ago
Philippe Antoine
0553dfa814
detect/krb5: move krb5_msg_type to rust
...
Makes it a generic u32 on the way
Unit tests are covered by SV tests
Ticket: 6723
1 year ago
Philippe Antoine
da486af881
detect: list-keywords cli shows integers
...
Ticket: 7875
1 year ago
Philippe Antoine
b298bce0e7
detect: list-keywords cli shows multi-buffers
...
Ticket: 7571
1 year ago
Andreas Dolp
375b5dd306
doc: fix typo /var/run/suricata in file permissions docs.
1 year ago
Andreas Dolp
cc590b54c7
doc: fix typo and missing newline in rules/ssh_keywords.
1 year ago
Andreas Dolp
228abb7da0
doc: fix doc syntax error in rate_filter example.
1 year ago
Juliana Fajardini
21b27597d6
doc/rules/internals: minor fixes
...
Fix typo and add a reference about the classtype keyword effect.
Related to
Task #5449
1 year ago
Fupeng Zhao
e79d735374
decode/etag: ETag 802.1BR decoder
...
Ticket: #3953 .
1 year ago
Philippe Antoine
cb9ab951b9
detect/integers: subslice for multi-integers
1 year ago
Philippe Antoine
82f0e725a2
detect/integers: index or_absent and or_oob
...
To match if array is empty, or index is out of bounds
1 year ago
Philippe Antoine
1480cf47ab
detect/integers: nb index to match a specific number of times
...
For example
dns.rrtype: !A,nb>3
will match if we have more than 3 dns records which are not A
1 year ago
Philippe Antoine
6f848eeaaf
detect/integers: all1 index to match only on non-empty arrays
1 year ago