91 Commits (cec1c9d8535429589e9b6a9ed0219a90737f3d35)

Author	SHA1	Message	Date
Shivani Bhardwaj	329ac61961	eve/stats: add description for ips ... Ticket 6434	10 months ago
Shivani Bhardwaj	861ffff972	eve/stats: add description for transactions ... Ticket 6434	10 months ago
Giuseppe Longo	bff790b6ac	rust/sdp: implement logger ... This implements a logger for the SDP protocol. Given that SDP is encapsulated within other protocols (such as SIP), enabling it separately is not necessary. Ticket #6627	10 months ago
Philippe Antoine	0291d37009	websocket: configurable logging of payload in alerts	11 months ago
Philippe Antoine	44b6aa5e4b	app-layer: websockets protocol support ... Ticket: 2695	11 months ago
Sascha Steinbiss	120313f4da	ja4: implement for TLS and QUIC ... Ticket: OISF#6379	11 months ago
Jeff Lucovsky	2dfa4cecb5	stats: Memcap pressure max relocation ... This commit moves the memcap pressure/pressure_max stats from the global stats namespace into the memcap namespace. With per-thread stats, they will be within the flow-manager's values. Issue: 6398	11 months ago
Juliana Fajardini	caf590d51f	stream/midstream: add counter for exception policy ... Add stats counters for when there is an exception policy applied in case of a session picked up midstream. Task #5816	11 months ago
Juliana Fajardini	fd9a20ffcf	stream/reassemble: add exception policy counters ... Add stats counters for exception policies applied in case of memcap hit during stream reassembly. Task #5816	11 months ago
Juliana Fajardini	2dee3772bf	stream/tcp: add ssnmemcap exception policy counter ... Add stats counters for exception policies applied in case a stream session memcap is hit. Task #5816	11 months ago
Juliana Fajardini	a71ace8575	applayer: add stats counters for exception errors ... Add stats counters for exception policy are applied for app-layer errors Part of Task #5816	11 months ago
Juliana Fajardini	485c0e1d9a	defrag: add exception policy memcap stats counters ... Add defrag memcap stats counter. Task #5816	11 months ago
Juliana Fajardini	657419b53e	decode/flow: add exception policy stats counters ... We will register stats counters for all policies, even though for now Suri only uses one possible configuration policy at a time. The idea is that this could change in the near future, so we want to have this ready. Task #5816	11 months ago
Juliana Fajardini	ce001d8eae	schema: apply clang formatting changes	11 months ago
Arne Welzel	f9cf87a003	schema: Add stats.capture and in_iface properties ... New suricata-verify test listens on loopback interface, resulting in the capture and in_iface fields in the stats and event objects.	12 months ago
Jason Ish	c2ecae9b82	schema: add flow.wrong_thread	1 year ago
Giuseppe Longo	c9d309219e	rust/sip: register parser for tcp ... This patch lets the parser to work over tcp protocol, taking care of handling data before calling the request/response parsers. Ticket #3351.	1 year ago
Hadiqa Alamdar Bukhari	6c193b1a3d	dns: add missing dns keywords to schema.json ... Found and added missing dns fields in schema.json after manual code review. Added description to these newly added dns fields. Feature #5642	1 year ago
Shivani Bhardwaj	487ba82fb9	eve/stats: add description for applayer flows ... Ticket 6434	1 year ago
Shivani Bhardwaj	8817514bea	eve/stats: add description for expectations ... Ticket 6434	1 year ago
Shivani Bhardwaj	1816e98ef0	eve/stats: add description for applayer errors ... Ticket 6434	1 year ago
Shivani Bhardwaj	5a1a32ba5b	eve/stats: add description for common fields ... Ticket 6434	1 year ago
Jason Ish	90ae3a223f	eve/schema: allow authorities in dns.answers in alert ... Factor out dns.authorities to a definition.	1 year ago
Jason Ish	b453eea150	stats: add rules skipped ... Rule skipped is a count of the number of rules that are skipped due to missing requirements. Feature: #6637	1 year ago
Philippe Antoine	f714678d72	schema: adds missing modbus field ... ./stats/app_layer/error/modbus	1 year ago
Juliana Fajardini	467c3f2c64	schema: apply clang formatting changes	1 year ago
Juliana Fajardini	30ac77ce65	pgsql: add cancel request message ... A CanceldRequest can occur after any query request, and is sent over a new connection, leading to a new flow. It won't take any reply, but, if processed by the backend, will lead to an ErrorResponse. Task #6577	1 year ago
Philippe Antoine	8c5310aefd	doc: quic in eve/schema ... Ticket: #6076	1 year ago
Jeff Lucovsky	904f0ddeee	stats: Track stream reassembly drops ... Issue: 6235	1 year ago
Yatin Kanetkar	b67ff4badf	dhcp: Log Vendor Client Identifier (dhcp option 60) ... * Log vendor client identifier (dhcp option 60) if extended dhcp logging is turned on. This required the `vendor_client_identifier` to be added to the json schema. Validation done using an SV Test * Added `requested_ip` to the json schema as well, since it was missed. My SV test failed without it. Feature #4587	2 years ago
Jason Ish	3802a51552	eve/schema: add host ... The "host" field is added to EVE events if the "sensor-name" field is configured in suricata.yaml.	2 years ago
Jeff Lucovsky	424f12d1b3	schema: Add memcap pressure values ... Issue: 6094 This commit extends the EVE schema with memcap_pressure values; these are included in the stat event type records.	2 years ago
Philippe Antoine	b12a35c3cf	output: add storing boolean for files ... When filestore keyword is triggered, the file is not yet stored, when the alert is generated, but only marked for storing. Ticket: 4881	2 years ago
Philippe Antoine	f35052941d	jsonschema: add missing field .files[].file_id	2 years ago
Victor Julien	1f9767a9cb	stats: add drop reason counters ... { "accepted": 296185, "blocked": 162, "rejected": 0, "replaced": 0, "drop_reason": { "decode_error": 0, "defrag_error": 0, "defrag_memcap": 0, "flow_memcap": 0, "flow_drop": 94, "applayer_error": 0, "applayer_memcap": 0, "rules": 3, "threshold_detection_filter": 0, "stream_error": 63, "stream_memcap": 0, "stream_midstream": 2, "nfq_error": 0, "tunnel_packet_drop": 0 } } Ticket: #6230.	2 years ago
Victor Julien	735c37c668	eve/schema: add ips capture stats	2 years ago
Juliana Fajardini	0437173848	output/drop: add verdict field ... Related to Bug #5464	2 years ago
Juliana Fajardini	53b8defd79	output/alert: add verdict field ... Related to Bug #5464	2 years ago
Philippe Antoine	4f4651e360	output/file: http2 metdata is logged in http object ... as is done for http2 events and alerts. The http.version integer can help to determine if this is HTTP2 Ticket: #6165	2 years ago
Juliana Fajardini	05417407b3	schema: add missing flow event property: emergency	2 years ago
Jeff Lucovsky	9dc68ac59a	json/schema: Add additional VLAN layer stat ... Issue: 2816 This commit extends the JSON schema with the additional VLAN stat for tracking VLAN encapsulated packets with 3 levels.	2 years ago
Eric Leblond	a73c9b0e40	output: target keys have port ... Update JSON schema to support signature with target keyword	2 years ago
Victor Julien	a8057eeed8	eve/schema: spelling	2 years ago
Philippe Antoine	416a780f69	jsonschema: do not enforce keys for alert metadata ... As this is a free field and can have any key based on a rule	2 years ago
Jason Ish	3a44197183	schema: add "message_id" to email	2 years ago
Jason Ish	bf079c9214	schema: fix optional ... "optional" is not part of jsonschema. Instead an array named "required" is used to list all field names that are required.	2 years ago
Jason Ish	49ba378d38	schema: fix engines section ... The definition of items is an object, not an array.	2 years ago
Lancer Cheng	08b17e9778	eve: add version and warning in ntlmssp ... Bug OISF#5783	2 years ago
Victor Julien	7e6154a26f	stream: add counter for acks for unseen data ... This is another indicator for packet loss or strange captures.	2 years ago
Victor Julien	83a16a7a89	eve/stream: per packet stream engine logging ... Debug facility to get a per packet view into the stream engine's state. Logs after a packet has been processed in the stream engine, so the view into the state includes the updates based on the current packet. Marked as experimental so it can be changed w/o notice. Bug: #5876.	2 years ago