Commit Graph

560 Commits (c0bdb6cc1033000dc260621dd28f4122eadb7fd3)

Author SHA1 Message Date
jason taylor c0bdb6cc10 doc: meta keyword doc example rule update
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor ca9e9009ba doc: add bsize keyword examples
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
Jufajardini Reichow f9c9091bb5 userguide: fix typo in inline mode illustration
The image describing Suricata's sliding window had two of the "packets"
with the same text. Now they actually give the sense of a sliding
window.

This was found by Zhiyuan-liao.
3 years ago
jason taylor 34e0a384ad doc: update to include additional rule references
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 4405704372 doc: update intro direction content
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 3eeacf8a3d doc: fixed HOME_NET/EXTERNAL example formatting
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor f2c7998903 doc: add clarity around HOME_NET/EXTERNAL_NET
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 76cca8b08a doc: minor example rule description update
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 4f61a35fe7 doc: minor wording restructure
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 845ba154a6 doc: add tcp-pkt/tcp-stream to intro
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 56f49bfe8e doc: minor punctuation update
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor ab300ab0ae doc: intro example rule update to simpler example
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 2f240230f0 doc: minor intro wording update
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
Philippe Antoine c7214be99b snmp: adds usm keyword
as is logged

Ticker: #5416
3 years ago
Juliana Fajardini 45b7aad2b5 devguide: incorporate contribution process page
That page existed only in our redmine. Updated and added a few things,
like a paragraph about our expectations for feature contributors.

Also updated links, contacts and some other processes that may have
changed since last edition.

Added some section labels in related documents, for ease of referencing.

Task #4929
3 years ago
Andreas Dolp db73a12540 doc/tls: Add documentation for TLS logging 3 years ago
Andreas Dolp f42bb45ccd doc/tls: Remove redundant example 3 years ago
Andreas Dolp 324f5ec10c doc: Add missing ")" in example 3 years ago
Andreas Dolp e4163c4e02 doc: Fix typos 3 years ago
Andreas Dolp 49bd6cfa5d doc: Fix broken link 3 years ago
Eric Leblond 6f06f7c22c doc: add info about capture_file key 3 years ago
Eric Leblond 0c7e4c13a1 doc: add conditional pcap logging info 3 years ago
jason taylor d799956348 doc: add note about file.data and file_data
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 83f2056d20 doc: update file_data to file.data keyword
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor cd54d0dbc8 doc: remove extra newline in order to match style
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 38bd775ca0 doc: remove extraneous + characters
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
Jason Ish 6ceeb08351 doc/userguide: updates for eve dns v1 removal
Ticket: #4157
3 years ago
Juliana Fajardini 1956dc3d5d userguide: explain alert queue behavior and stats
Added sections along packet-alert-max config section explaining
packet alert queue overflow (when Suri reaches packet alert max), when
alerts are discarded etc.

Since from the user perspective it shouldn't matter how we process the
alert queue, the term "replace" is used, even though there's not exactly
a replacing action happening, with the queue bein pre-processed before
being appended to the Packet.

Also described the associated stats and added an explanation on when to
change packet-alert-max.

Task #5178
3 years ago
Juliana Fajardini 49542d0f1b doc/userguide: explain packet-alert-max config
Task #4207
3 years ago
Jason Ish 7d6bc60abb doc/userguide: document ftp max-line-length 3 years ago
Victor Julien 976748b777 doc/smb: add resource limits section 3 years ago
William Harding f0528afc2d doc/userguide: sphinx syntax correction 3 years ago
Juliana Fajardini 55843aee8e devguide: update readme
Use it to explain how to go about the sequence diagram images
(generation, updating, what is mscgen etc).

Also remove portion that referred to Sphinx builds, as these don't make
sense now.
3 years ago
Juliana Fajardini e0c8dba7ac userguide: dynamically determine copyright date
This uses the date of doc generation to determine the copyright date
for the trailing date. Based on Jeff Lucovsky solution.
3 years ago
Juliana Fajardini 67af1504b3 devguide: drop use of mscgen script in builds/make
Currently, it seems easier to upload the diagram images to git than to
try to make the image generation script work with out of the tree builds
and other corner cases.

This means, however, that one must activelly remember to update msc
diagram files, run the script and re-add new png files, if those ever
need to be updated. To raise awareness to that, a watermark was added
to the diagram images.

Also removed configuration steps that added mscgen as dependency
(locally and for workflow builds and readthedocs).
3 years ago
Juliana Fajardini 5d63613c4b devguide: add watermark to sequence diagrams
Make it more evident that the sequence diagrams in the transactions
page are generated with Mscgen
3 years ago
Juliana Fajardini 6f77c722a2 devguide: move into userguide as last chapter
Moved devguide dir into userguide dir.
Since the devguide is now incorporated as the last chapter of the
userguide, removed build and configuration files from the devguide
dir, as these are no longer needed.

Task #4909
3 years ago
Philippe Antoine cfcade58ad http: move xff logging to alert object
Ticket: 4860

instead of root field
3 years ago
Andreas Dolp d4144c04cd Doc: Fix typo in documentation of suricata.yaml. 3 years ago
Shivani Bhardwaj 015c9fe1e3 doc: add usage of flowbits OR op
Ticket 5130
3 years ago
Jeff Lucovsky 117e11b0ae doc: Describe per-thread stack size config setting
Issue: 4550

This commit documents the new per-thread stack-size setting. Some
systems have a small default value that is not suitable for Suricata's
multi-threaded architecture and adjustment may be required.
3 years ago
Victor Julien e04fcfcf2f doc/userguide: minor rewording and reformatting for runmodes 3 years ago
Philippe Antoine 8adf172ab8 nfs: limits the number of active transactions per flow
Ticket: 4530
3 years ago
Philippe Antoine 11d3af551b doc: suricata.yaml fields about maximum transactions
For HTTP2, MQTT and FTP.
4 years ago
Juliana Fajardini 579d7dcc01 pgsql: add initial support
- add nom parsers for decoding most messages from StartupPhase and
SimpleQuery subprotocols
- add unittests
- tests/fuzz: add pgsql to confyaml

Feature: #4241
4 years ago
Victor Julien cf4ddab6f4 doc/quic: update for new quic.version logic 4 years ago
Emmanuel Thompson 6641efb74f doc/quic: Add documentation for QUIC keywords 4 years ago
Emmanuel Thompson 9ad60e7661 doc/quic: Add quic to eve json format 4 years ago
Andreas Dolp f714484591 Doc: Fix typos in documentation of suricata.yaml. 4 years ago
Philippe Antoine 0cfdec1266 detect: xor transform
Ticket: 3285

The xor transform applies xor decoding to a buffer, with a key
specified as an option in hexadecimal. Arbitrary key sizes are
accepted.
4 years ago