suricata

Commit Graph

Author	SHA1	Message	Date
Juliana Fajardini	caf590d51f	stream/midstream: add counter for exception policy Add stats counters for when there is an exception policy applied in case of a session picked up midstream. Task #5816	2 years ago
Juliana Fajardini	fd9a20ffcf	stream/reassemble: add exception policy counters Add stats counters for exception policies applied in case of memcap hit during stream reassembly. Task #5816	2 years ago
Juliana Fajardini	2dee3772bf	stream/tcp: add ssnmemcap exception policy counter Add stats counters for exception policies applied in case a stream session memcap is hit. Task #5816	2 years ago
Juliana Fajardini	a71ace8575	applayer: add stats counters for exception errors Add stats counters for exception policy are applied for app-layer errors Part of Task #5816	2 years ago
Juliana Fajardini	485c0e1d9a	defrag: add exception policy memcap stats counters Add defrag memcap stats counter. Task #5816	2 years ago
Juliana Fajardini	657419b53e	decode/flow: add exception policy stats counters We will register stats counters for all policies, even though for now Suri only uses one possible configuration policy at a time. The idea is that this could change in the near future, so we want to have this ready. Task #5816	2 years ago
Juliana Fajardini	ce001d8eae	schema: apply clang formatting changes	2 years ago
Arne Welzel	f9cf87a003	schema: Add stats.capture and in_iface properties New suricata-verify test listens on loopback interface, resulting in the capture and in_iface fields in the stats and event objects.	2 years ago
Jason Ish	c2ecae9b82	schema: add flow.wrong_thread	2 years ago
Giuseppe Longo	c9d309219e	rust/sip: register parser for tcp This patch lets the parser to work over tcp protocol, taking care of handling data before calling the request/response parsers. Ticket #3351.	2 years ago
Hadiqa Alamdar Bukhari	6c193b1a3d	dns: add missing dns keywords to schema.json Found and added missing dns fields in schema.json after manual code review. Added description to these newly added dns fields. Feature #5642	2 years ago
Shivani Bhardwaj	487ba82fb9	eve/stats: add description for applayer flows Ticket 6434	2 years ago
Shivani Bhardwaj	8817514bea	eve/stats: add description for expectations Ticket 6434	2 years ago
Shivani Bhardwaj	1816e98ef0	eve/stats: add description for applayer errors Ticket 6434	2 years ago
Shivani Bhardwaj	5a1a32ba5b	eve/stats: add description for common fields Ticket 6434	2 years ago
Jason Ish	90ae3a223f	eve/schema: allow authorities in dns.answers in alert Factor out dns.authorities to a definition.	2 years ago
Jason Ish	b453eea150	stats: add rules skipped Rule skipped is a count of the number of rules that are skipped due to missing requirements. Feature: #6637	2 years ago
Philippe Antoine	f714678d72	schema: adds missing modbus field ./stats/app_layer/error/modbus	2 years ago
Juliana Fajardini	467c3f2c64	schema: apply clang formatting changes	2 years ago
Juliana Fajardini	30ac77ce65	pgsql: add cancel request message A CanceldRequest can occur after any query request, and is sent over a new connection, leading to a new flow. It won't take any reply, but, if processed by the backend, will lead to an ErrorResponse. Task #6577	2 years ago
Philippe Antoine	8c5310aefd	doc: quic in eve/schema Ticket: #6076	2 years ago
Jeff Lucovsky	904f0ddeee	stats: Track stream reassembly drops Issue: 6235	3 years ago
Yatin Kanetkar	b67ff4badf	dhcp: Log Vendor Client Identifier (dhcp option 60) * Log vendor client identifier (dhcp option 60) if extended dhcp logging is turned on. This required the `vendor_client_identifier` to be added to the json schema. Validation done using an SV Test * Added `requested_ip` to the json schema as well, since it was missed. My SV test failed without it. Feature #4587	3 years ago
Jason Ish	3802a51552	eve/schema: add host The "host" field is added to EVE events if the "sensor-name" field is configured in suricata.yaml.	3 years ago
Jeff Lucovsky	424f12d1b3	schema: Add memcap pressure values Issue: 6094 This commit extends the EVE schema with memcap_pressure values; these are included in the stat event type records.	3 years ago
Philippe Antoine	b12a35c3cf	output: add storing boolean for files When filestore keyword is triggered, the file is not yet stored, when the alert is generated, but only marked for storing. Ticket: 4881	3 years ago
Philippe Antoine	f35052941d	jsonschema: add missing field .files[].file_id	3 years ago
Victor Julien	1f9767a9cb	stats: add drop reason counters { "accepted": 296185, "blocked": 162, "rejected": 0, "replaced": 0, "drop_reason": { "decode_error": 0, "defrag_error": 0, "defrag_memcap": 0, "flow_memcap": 0, "flow_drop": 94, "applayer_error": 0, "applayer_memcap": 0, "rules": 3, "threshold_detection_filter": 0, "stream_error": 63, "stream_memcap": 0, "stream_midstream": 2, "nfq_error": 0, "tunnel_packet_drop": 0 } } Ticket: #6230.	3 years ago
Victor Julien	735c37c668	eve/schema: add ips capture stats	3 years ago
Juliana Fajardini	0437173848	output/drop: add verdict field Related to Bug #5464	3 years ago
Juliana Fajardini	53b8defd79	output/alert: add verdict field Related to Bug #5464	3 years ago
Philippe Antoine	4f4651e360	output/file: http2 metdata is logged in http object as is done for http2 events and alerts. The http.version integer can help to determine if this is HTTP2 Ticket: #6165	3 years ago
Juliana Fajardini	05417407b3	schema: add missing flow event property: emergency	3 years ago
Jeff Lucovsky	9dc68ac59a	json/schema: Add additional VLAN layer stat Issue: 2816 This commit extends the JSON schema with the additional VLAN stat for tracking VLAN encapsulated packets with 3 levels.	3 years ago
Eric Leblond	a73c9b0e40	output: target keys have port Update JSON schema to support signature with target keyword	3 years ago
Victor Julien	a8057eeed8	eve/schema: spelling	3 years ago
Philippe Antoine	416a780f69	jsonschema: do not enforce keys for alert metadata As this is a free field and can have any key based on a rule	3 years ago
Jason Ish	3a44197183	schema: add "message_id" to email	3 years ago
Jason Ish	bf079c9214	schema: fix optional "optional" is not part of jsonschema. Instead an array named "required" is used to list all field names that are required.	3 years ago
Jason Ish	49ba378d38	schema: fix engines section The definition of items is an object, not an array.	3 years ago
Lancer Cheng	08b17e9778	eve: add version and warning in ntlmssp Bug OISF#5783	3 years ago
Victor Julien	7e6154a26f	stream: add counter for acks for unseen data This is another indicator for packet loss or strange captures.	3 years ago
Victor Julien	83a16a7a89	eve/stream: per packet stream engine logging Debug facility to get a per packet view into the stream engine's state. Logs after a packet has been processed in the stream engine, so the view into the state includes the updates based on the current packet. Marked as experimental so it can be changed w/o notice. Bug: #5876.	3 years ago
Victor Julien	66ed3ae6e4	flow/mgr: remove flows_timeout_inuse counter	3 years ago
Jason Ish	59d9a51bad	eve: remove dcerpc.interface from schema Looks like this was due to an error in the dcerpc logging where the interfaces should have been logged to the "interfaces" array that was already defined. Issue: 5814	3 years ago
Jason Ish	ef48c5064f	schema: add regular expression for tls date format	3 years ago
Jeff Lucovsky	c1c67536b6	decode/stat: Add decode counters for unknown/arp Issue: 5761 This commit adds statistics for ARP and unknown ethertype packets for diagnostic purposes.	3 years ago
Shivani Bhardwaj	8e3acf1695	eve/schema: add udp.len_invalid	3 years ago
Jason Ish	c98c49d4ba	dns: parse and alert on invalid opcodes Accept DNS messages with an invalid opcode that are otherwise valid. Such DNS message will create a parser event. This is a change of behavior, previously an invalid opcode would cause the DNS message to not be detected or parsed as DNS. Issue: #5444	3 years ago
Victor Julien	96dfd65b96	eve: log max regions	3 years ago

1 2

79 Commits (caf590d51f276089f6940afa1d9fb94957e0a504)