130 Commits (bb128e3959b4d73d31031e0a3e34f1215ca57bc7)

Author	SHA1	Message	Date
Sascha Steinbiss	cb14e44780	userguide: fix spelling of `security_result` EVE field ... This ensures that the correct spelling of the `security_result` EVE field for RFB (as opposed to `security-result`) is also reflected in the documentation. Ticket: #7210	1 year ago
Jason Ish	5853fb922d	tls-log: deprecate ... tls-log is now deprecated and will be removed in Suricata 9.0. Display a deprecation notice on use, and add notes to the user guide. Ticket: #6542	1 year ago
Jason Ish	ab26323a96	http-log: deprecate ... http-log is now deprecated and will be removed in Suricata 9.0. Display a deprecation notice on use, and add notes to the userguide. Issue: #6543	1 year ago
Philippe Antoine	e0fd59a20d	doc: state that payload-length includes the gaps	1 year ago
Jason Ish	4d3d57249a	doc: update dns section of the eve format documentation	1 year ago
Sascha Steinbiss	53c62432c6	doc: update MQTT configuration	1 year ago
Philippe Antoine	c9ce43b31e	output: configurable payload_length field for alerts ... Ticket: 7098	1 year ago
Victor Julien	c79a382e42	eve/tls: log ALPN for client and server ... Part of the extended logging. Logs `client_alpns` and `server_alpns` arrays in the tls object. Ticket: #7055.	1 year ago
Giuseppe Longo	8a171c9d74	doc: add arp changes	1 year ago
Juliana Fajardini	bb59124063	yaml: unify 0 stats counter config option terms ... When we added feature #5976 (72146b969), we overlook that we also have a config stats option for the human-readable stats logs to output 0 counters. Due to not seeing this before, we now have two different setting names for basically the same thing, but in different logs: - zero-valued-counters for EVE - null-values for stats.log This ensures we use the same terminology, and change the recently added one to `null-values`, as this one has been around for longer. Task #6962	1 year ago
Sascha Steinbiss	120313f4da	ja4: implement for TLS and QUIC ... Ticket: OISF#6379	1 year ago
Juliana Fajardini	72146b969c	eve/stats: allow hiding counters whose valued is 0 ... Some stats can be quite verbose if logging all zero valued-counters. This allows users to disable logging such counters. Default is still true, as that's the expected behavior for the engine. Task #5976	1 year ago
Lukas Sismis	6e4cc79b39	doc: remove references to prehistoric versions ... Remove references that are mentioning Suricata 3 or less As a note - only one Suricata 4 reference found: (suricata-yaml.rst:"In 4.1.x") Fast pattern selection criteria can be internally found by inspecting SupportFastPatternForSigMatchList and SigTableSetup functions. Ticket: #6570	2 years ago
Juliana Fajardini	bba3d4fc63	userguide/eve: explain pgsql requests & responses ... Add a more visible explanation of that requests, responses, frontend and and backend are, in Pgsql context, to avoid having to repeat that over different portions of the docs.	2 years ago
Juliana Fajardini	30ac77ce65	pgsql: add cancel request message ... A CanceldRequest can occur after any query request, and is sent over a new connection, leading to a new flow. It won't take any reply, but, if processed by the backend, will lead to an ErrorResponse. Task #6577	2 years ago
Juliana Fajardini	7dcc2e7a71	doc/eve-format: break pgsql section to char limit	2 years ago
Juliana Fajardini	a649a92afd	userguide: update tls not_after/not_before mentions ... Our tls fields not_after and not_before are actually logged as `notafter` and `notbefore`, but were documented with the underscore. Update the documentation, since updating the log format itself would be a breaking change. Task #5494	2 years ago
Juliana Fajardini	58fb559594	userguide: document flow_id, with examples ... Flow_id explanation expanded from version shared by Peter Manev. Task #6445	2 years ago
Juliana Fajardini	9900bdc162	userguide/eve: format and reorganize alert section ... The `field action` portion seemed to be comprised of a more generic section that followed it. Also formatted the section for lines to be within the character limit.	2 years ago
Juliana Fajardini	0437173848	output/drop: add verdict field ... Related to Bug #5464	2 years ago
Philippe Antoine	9287cbc33a	http: logs custom headers in a subobject ... This subobject is request_headers or response_headers This especially avoids json keys collisions. Ticket: #5320 Also fixes typo referrer/referer	2 years ago
Victor Julien	c0d9b3c078	doc/userguide: spelling	2 years ago
Lancer Cheng	6142593a69	doc: add version filed in NTLMSSP documentation ... Bug OISF#5783	3 years ago
jason taylor	8e5b1fe8e6	userguide: add DHCP EVE log information ... Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Jason Ish	9d653512f9	doc/userguide: update bittorrent-dht eve examples ... Update the bittorrent-dht examples using real log records with peers and nodes broken down into objects.	3 years ago
Jason Ish	065f3ab9f1	doc: rename bittorrent-dht to bittorrent_dht in eve output	3 years ago
Aaron Bungay	d166c48d28	docs: update for bittorrent-dht app-layer	3 years ago
Lukas Sismis	e101384e7b	transversal: remove suricata-ids.org references	3 years ago
Andreas Dolp	db73a12540	doc/tls: Add documentation for TLS logging	3 years ago
Andreas Dolp	f42bb45ccd	doc/tls: Remove redundant example	3 years ago
Eric Leblond	6f06f7c22c	doc: add info about capture_file key	3 years ago
Jason Ish	6ceeb08351	doc/userguide: updates for eve dns v1 removal ... Ticket: #4157	3 years ago
Juliana Fajardini	579d7dcc01	pgsql: add initial support ... - add nom parsers for decoding most messages from StartupPhase and SimpleQuery subprotocols - add unittests - tests/fuzz: add pgsql to confyaml Feature: #4241	4 years ago
Emmanuel Thompson	9ad60e7661	doc/quic: Add quic to eve json format	4 years ago
Odin Jenseg	2a5d79e426	doc/eve-json-format/dns: Describing Z-bit	4 years ago
Juliana Fajardini	7c636d25c7	userguide: (nit) fix typo in lua-output page	4 years ago
Juliana Fajardini	6b8b58f98a	doc/eve: common fields and alert updates ... - update examples for both - change app_proto from alert field to common field, as per JsonBuilder's changes.	4 years ago
Juliana Fajardini	eacf933edf	doc/eve: fix typos	4 years ago
Simon Dugas	0ed62e93ec	doc/modbus: add eve logging documentation	4 years ago
frank honza	f83d51d0cb	ike: set event for multiple server proposals	4 years ago
frank honza	ab59ef0d79	ikev1: add documentation for ikev1	5 years ago
Justin Ossevoort	320de5f43d	eve: Log tenant_id for all eve-json messages	5 years ago
Sascha Steinbiss	15c42e0d83	doc: add documentation for SRV DNS JSON structure	5 years ago
Jeff Lucovsky	6f9b7e052a	doc/eve: Update threaded filename examples	5 years ago
Jason Ish	7d44e80a50	doc: document removal of unified2 ... And suggest an alternate tool, Meer if compatibility with Barnyard2 style databases is required. Redmine ticket: https://redmine.openinfosecfoundation.org/issues/3497	5 years ago
Jason Ish	e71f2b22fa	doc: add removal of individual json loggers ... Add link to multiple eve instances as a replacement for this feature.	5 years ago
Simon Dugas	48da18b081	doc: dns - document additional fields in eve event ... Documentation of additional fields for soa and sshfp. Also some minor doc fixes and updates.	5 years ago
Philippe Antoine	999af4f62a	http2: adds documentation	5 years ago
Sascha Steinbiss	4e1a41a17d	output-json: add MAC address output ... This commit adds MAC address output to the EVE-JSON format. We follow the remarks made in Redmine ticket #962: for packets, log MAC src/dst as a scalar field in EVE; for flows, log MAC src/dst as lists in EVE. Field names are different between flow and packet context to avoid type confusion (src_mac vs. src_macs). Configuration approach and JSON representation is taken from previous GitHub PR #2700.	5 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	5 years ago