suricata

Commit Graph

Author	SHA1	Message	Date
James Dutrisac	8d5e54c046	pcap: recusively reading pcaps / documentation Changes to doc/userguide/partials/options.rst for feature 2363 (reading pcaps recursively)	5 years ago
Jeff Lucovsky	a5d30a3220	doc/output: Document multithreaded eve option	5 years ago
Victor Julien	75727c05e0	doc/manpage: add --reject-dev option	5 years ago
Jeff Lucovsky	3385859176	doc/userguide: Update for dump-features	6 years ago
Daisu	fccdb1c642	doc/commandline: -i option is useable several times	6 years ago
Jason Ish	9111b9df57	doc: cleanup enging logging Attempt cleanup the engine logging a bit. Also a include a verbatim excerpt of the default configuration here for reference purposes.	6 years ago
Jason Ish	c97195bf0b	doc: -v verbose option documentation update Update -v documentation to reflect the new behaviour discussed in bug #1851 where -v changes the log level to fixed levels instead of an offset of the default log level configured in suricata.yaml.	6 years ago
Jeff Lucovsky	17c3e22ecd	doc/eve.alert: Expand metadata description	6 years ago
Jason Ish	9488002a0d	doc: use describe instead of option for old Sphinx Older versions of Sphinx will generate duplicate IDs when you have options like: .. option:: some-option .. option:: some-other-option The version of Sphinx provided on CentOS 7 has this issue, newer versions of Sphinx do not. As CentOS 7 is still a popular distribution, change ".. option" to ".. describe" which has the same visual output, but does not generate links.	6 years ago
Shivani Bhardwaj	4705314fd2	doc: Add manpages for suricatasc and suricatactl Add the missing manpages and the corresponding Sphinx configuration for the command line tools `suricatasc` and `suricatactl`. Closes redmine ticket #884.	6 years ago
Jason Ish	75a018ead2	doc: remove autoconf replacement var for Rust Set to yes as Rust is always enabled now.	6 years ago
Victor Julien	6fcd2db043	tile: remove files	7 years ago
Danny Browning	2dc6b6ee14	source-pcap-file: delete when done (2417) https://redmine.openinfosecfoundation.org/issues/2417 Add option to have pcap files deleted after they have been processed. This option combines well with pcap file continuous and streaming files to a directory being processed.	7 years ago
Jason Ish	fb85822730	dhcp: update user guide	7 years ago
Pascal Delalande	4f48927c44	doc: spelling mistakes in various sections of the user guide	7 years ago
Pierre Chifflier	6eb48e1e93	Add ikev2 to userguide	7 years ago
Giuseppe Longo	fb66d45754	doc: introduce dns compact logging	7 years ago
Brandon Sterne	a01a229b37	doc: use standard spelling of daemon	8 years ago
Jason Ish	74e036d09f	doc: update eve/alert/metadata configuration	8 years ago
Martin Natano	fe9cac5870	eve/alert: include rule text in alert output For SIEM analysis it is often useful to refer to the actual rules to find out why a specific alert has been triggered when the signature message does not convey enough information. Turn on the new rule flag to include the rule text in eve alert output. The feature is turned off by default. With a rule like this: alert dns $HOME_NET any -> 8.8.8.8 any (msg:"Google DNS server contacted"; sid:42;) The eve alert output might look something like this (pretty-printed for readability): { "timestamp": "2017-08-14T12:35:05.830812+0200", "flow_id": 1919856770919772, "in_iface": "eth0", "event_type": "alert", "src_ip": "10.20.30.40", "src_port": 50968, "dest_ip": "8.8.8.8", "dest_port": 53, "proto": "UDP", "alert": { "action": "allowed", "gid": 1, "signature_id": 42, "rev": 0, "signature": "Google DNS server contacted", "category": "", "severity": 3, "rule": "alert dns $HOME_NET any -> 8.8.8.8 any (msg:\"Google DNS server contacted\"; sid:43;)" }, "app_proto": "dns", "flow": { "pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 81, "bytes_toclient": 0, "start": "2017-08-14T12:35:05.830812+0200" } } Feature #2020	8 years ago
Eric Leblond	72c8cd67d5	doc: documentation update on metadata	8 years ago
Jason Ish	ab939f4aaa	doc: breakout eve-log section to a partial file Both the suricata.yaml and eve configuration sections included the eve-log section from suricata.yaml. First, sync these up with the actual suricata.yaml then break it out into its own file, so only one file needs to be kept in sync with the actual configuration file.	8 years ago
Dana Helwig	3ab9120821	source-pcap-file: Pcap Directory Mode (Feature #2222 ) https://redmine.openinfosecfoundation.org/issues/2222 Pcap file mode that when passed a directory will process all files in that directory. If --pcap-file-continuous or continuous option is passed in json, the directory will be monitored until the directory is moved/deleted, suricata is interrupted, or the pcap-interrupt command is used with unix command socket. Existing file implementation and new directory implementation has moved from source-pcap-file into pcap-file-helper and pcap-directory-helper. Engine state will not reset between files. Also satisfies: * https://redmine.openinfosecfoundation.org/issues/2299 * https://redmine.openinfosecfoundation.org/issues/724 * https://redmine.openinfosecfoundation.org/issues/1476 Co-Authors: Dana Helwig <dana.helwig@protectwise.com> and Danny Browning <danny.browning@protectwise.com>	8 years ago
Jason Ish	5c78fdbc9c	doc: break out command line options into a common doc The command line options can now be consumed by the man page and the user guide. Some attempt was made to order the options from common/basic progressing to advanced with some notion of options grouped together.	9 years ago

24 Commits (b8994cdaca119360ff8f18cc2432460d10142c5d)