855 Commits (cf8b630ed2e62116989b3d27ab8213b28217e0ea)

Author	SHA1	Message	Date
Andreas Dolp	f42bb45ccd	doc/tls: Remove redundant example	3 years ago
Andreas Dolp	324f5ec10c	doc: Add missing ")" in example	3 years ago
Andreas Dolp	e4163c4e02	doc: Fix typos	3 years ago
Andreas Dolp	49bd6cfa5d	doc: Fix broken link	3 years ago
Eric Leblond	6f06f7c22c	doc: add info about capture_file key	3 years ago
Eric Leblond	0c7e4c13a1	doc: add conditional pcap logging info	3 years ago
jason taylor	d799956348	doc: add note about file.data and file_data ... Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	83f2056d20	doc: update file_data to file.data keyword ... Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	cd54d0dbc8	doc: remove extra newline in order to match style ... Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	38bd775ca0	doc: remove extraneous + characters ... Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Jason Ish	6ceeb08351	doc/userguide: updates for eve dns v1 removal ... Ticket: #4157	3 years ago
Juliana Fajardini	1956dc3d5d	userguide: explain alert queue behavior and stats ... Added sections along packet-alert-max config section explaining packet alert queue overflow (when Suri reaches packet alert max), when alerts are discarded etc. Since from the user perspective it shouldn't matter how we process the alert queue, the term "replace" is used, even though there's not exactly a replacing action happening, with the queue bein pre-processed before being appended to the Packet. Also described the associated stats and added an explanation on when to change packet-alert-max. Task #5178	3 years ago
Juliana Fajardini	49542d0f1b	doc/userguide: explain packet-alert-max config ... Task #4207	3 years ago
Jason Ish	7d6bc60abb	doc/userguide: document ftp max-line-length	3 years ago
Victor Julien	976748b777	doc/smb: add resource limits section	3 years ago
William Harding	f0528afc2d	doc/userguide: sphinx syntax correction	3 years ago
Juliana Fajardini	55843aee8e	devguide: update readme ... Use it to explain how to go about the sequence diagram images (generation, updating, what is mscgen etc). Also remove portion that referred to Sphinx builds, as these don't make sense now.	3 years ago
Juliana Fajardini	e0c8dba7ac	userguide: dynamically determine copyright date ... This uses the date of doc generation to determine the copyright date for the trailing date. Based on Jeff Lucovsky solution.	3 years ago
Juliana Fajardini	67af1504b3	devguide: drop use of mscgen script in builds/make ... Currently, it seems easier to upload the diagram images to git than to try to make the image generation script work with out of the tree builds and other corner cases. This means, however, that one must activelly remember to update msc diagram files, run the script and re-add new png files, if those ever need to be updated. To raise awareness to that, a watermark was added to the diagram images. Also removed configuration steps that added mscgen as dependency (locally and for workflow builds and readthedocs).	3 years ago
Juliana Fajardini	5d63613c4b	devguide: add watermark to sequence diagrams ... Make it more evident that the sequence diagrams in the transactions page are generated with Mscgen	3 years ago
Juliana Fajardini	6f77c722a2	devguide: move into userguide as last chapter ... Moved devguide dir into userguide dir. Since the devguide is now incorporated as the last chapter of the userguide, removed build and configuration files from the devguide dir, as these are no longer needed. Task #4909	3 years ago
Juliana Fajardini	69c6657127	devguide: clarify cargo test usage for modules ... The documentation was showing an invalid path for running single tests.	3 years ago
Philippe Antoine	cfcade58ad	http: move xff logging to alert object ... Ticket: 4860 instead of root field	3 years ago
Andreas Dolp	d4144c04cd	Doc: Fix typo in documentation of suricata.yaml.	3 years ago
Shivani Bhardwaj	015c9fe1e3	doc: add usage of flowbits OR op ... Ticket 5130	3 years ago
Juliana Fajardini	6c616d84b1	devguide: clarify style guide for getframe funcs ... As the GetFrameIdByName can be probed, we must warn developers not to leave any output in them, or misleading messages could be printed. Task #5129	3 years ago
Jeff Lucovsky	117e11b0ae	doc: Describe per-thread stack size config setting ... Issue: 4550 This commit documents the new per-thread stack-size setting. Some systems have a small default value that is not suitable for Suricata's multi-threaded architecture and adjustment may be required.	3 years ago
Victor Julien	e04fcfcf2f	doc/userguide: minor rewording and reformatting for runmodes	3 years ago
Juliana Fajardini	28b5f4a555	devguide: add page about app-layer frame support ... This explains the frame support from the perspective of a developer, with introductory explanation on how to add frame support to an applayer proto. Doc #4697	3 years ago
Philippe Antoine	8adf172ab8	nfs: limits the number of active transactions per flow ... Ticket: 4530	3 years ago
Jason Ish	b9a429e6ce	devguide: move image generation into sphinx setup ... While ReadTheDocs can't execute arbitrary scripts, we can install mscgen in the container that builds the docs (see .readthedocs.yaml). Then instead of calling generate-images.sh from the Makefile, move this into the setup function defined on conf.yaml, which will generate the scripts as part of a normal Sphinx workflow. This should give us an image generation solution that works on ReadTheDocs, and locally within anyones build system provided they have mscgen installed.	3 years ago
Philippe Antoine	11d3af551b	doc: suricata.yaml fields about maximum transactions ... For HTTP2, MQTT and FTP.	3 years ago
Juliana Fajardini	579d7dcc01	pgsql: add initial support ... - add nom parsers for decoding most messages from StartupPhase and SimpleQuery subprotocols - add unittests - tests/fuzz: add pgsql to confyaml Feature: #4241	3 years ago
Victor Julien	cf4ddab6f4	doc/quic: update for new quic.version logic	3 years ago
Emmanuel Thompson	6641efb74f	doc/quic: Add documentation for QUIC keywords	3 years ago
Emmanuel Thompson	9ad60e7661	doc/quic: Add quic to eve json format	3 years ago
Andreas Dolp	f714484591	Doc: Fix typos in documentation of suricata.yaml.	3 years ago
Philippe Antoine	0cfdec1266	detect: xor transform ... Ticket: 3285 The xor transform applies xor decoding to a buffer, with a key specified as an option in hexadecimal. Arbitrary key sizes are accepted.	3 years ago
Jason Ish	cda11b8d97	doc/update: mention change of default rule path	3 years ago
Jason Ish	8071d8239e	doc: update rule section to current default ... Update the rule section to better describe whats seen in a default install of Suricata including a link to the rule management section.	3 years ago
Jeff Lucovsky	93842aa14a	doc/yaml: Signal-termination option description	3 years ago
Juliana Fajardini	6ae80b2819	doc: replace ohloh with openhub link	3 years ago
Juliana Fajardini	de0ce26e3f	userguide: update references to Suricata website ... Many places were still referencing the old Suricata page. Used git grep with replace to update them. Checked that new links work. Left old references when they were only documentation examples (for output or unittests). Task#4915	3 years ago
Juliana Fajardini	7b20488d4e	userguide: fix low-hanging typos Config page	3 years ago
Odin Jenseg	2a5d79e426	doc/eve-json-format/dns: Describing Z-bit	3 years ago
Lukas Sismis	dab3274263	dpdk: add documentation for the DPDK runmode ... Briefly present the DPDK runmode through configuration file.	3 years ago
Lukas Sismis	e4b5239202	doc: fix typo in "Stream engine" documentation	3 years ago
Philippe Antoine	27dd0c6b3d	eve/ftp-data: log alert metadata in ftp-data object ... Ticket: 4860 instead of directly in root	3 years ago
Juliana Fajardini	7c636d25c7	userguide: (nit) fix typo in lua-output page	3 years ago
Juliana Fajardini	4256c1ccd5	userguide: rename pg Lua Scripting->Lua Detection ... Since we can have scripts for output _or_ detection, it seems more clear to rename this page to add more meaning	3 years ago
Juliana Fajardini	59e5a21fca	userguide: update buffers list for lua-scripting	3 years ago
Juliana Fajardini	e7f1736f3a	userguide/lua: add explanation about `need` diffs ... The differences on how the `need` key works, depending on script usage (output or detection) confuses users, sometimes (cf doc#4725). While we don't fix that, just explain this behavior.	3 years ago
Andreas Dolp	b25350ee13	doc: Fix typo in documentation of rule keyword flow	3 years ago
Juliana Fajardini	c6e97222b7	devguide: add page about rust unittests ... Part of the task to offer better guidance on how and when to write unit tests or suricata-verify tests Also updated linking and index files, as well as testing page to refer to the unit tests pages Doc: #4590	3 years ago
Juliana Fajardini	747d225c84	devguide: repurpose unittests page to unittests-c ... Part of ongoing task to add more guidance on how to create unittests and suricata-verify tests for suri. There will also be a unittests-rust page. Doc: #4590	3 years ago
Juliana Fajardini	5b4c575f3b	devguide: add page about testing ... This page offers guidance about when to use unittests or s-v tests, and how to create input for those. Also lists other common ways to test Suri, such as fuzzing and the CI checks. Doc: #4590	3 years ago
Juliana Fajardini	fc958e9e89	userguide: update wiresharkwiki in public datasets	3 years ago
Juliana Fajardini	dbeb8bfa1f	doc/devguide: add few more explanations & details	3 years ago
Juliana Fajardini	2cd25e8105	devguide/app-layer: rename /img dir to /diagrams ... Semantically speaking it makes more sense, because it stores `msc` files for dynamic image generation. Updated files that refered to `img` accordingly, too.	3 years ago
Juliana Fajardini	f65b3908ed	devguide/transactions: add TSL_STATE enum snippet	3 years ago
Juliana Fajardini	d6c5dfacc7	devguide/transactions: update & refine diagrams ... - DNS sequence diagram was incorrect (transactions should be unidirectional). After changing it, it made sense to rename the file. Adjusted spacing, too. Updated transactions.rst accordingly. - TLS sequence diagram was refined to illustrate how Suricata actually implements the protocol.	3 years ago
Juliana Fajardini	84311ab151	devguide/transactions: fix wordings	3 years ago
Juliana Fajardini	2f3cee2429	devguide/code-style: fix typo in banned functions	3 years ago
Juliana Fajardini	a5b344e015	doc/devguide: add Transactions documentation page ... A guide on what is a transaction for Suricata engine, focusing on developers. - What's the purpose of a transaction; - transaction states and API callbacks; - Examples and sequence diagrams. - doc/devguide: add transactions.rst - doc/devguide/extending/app-layer/index.rst: add transactions.rst	3 years ago
Philippe Antoine	bce3c46874	pcre2: remove PCRE1 as dependency	3 years ago
Philippe Antoine	fae7389ae2	pcre2: document the behavioral changes	3 years ago
Juliana Fajardini	751906b71d	doc/lua-functions: add sha items to SCFileInfo doc	4 years ago
Jason Ish	2cff811609	doc: remove prelude and document as removed	4 years ago
Jason Ish	3e9d1e813a	doc/upgrade: move ike logging changes to 7.0 changes ... Was mistakenly put in 6.0 changes.	4 years ago
Jason Ish	f56634ac46	doc/upgrade: mention that nss is no longer required	4 years ago
Lukas Sismis	71196098a1	doc: Update public-data-sets.rst ... Replace dead link Dataset on ll.mit.edu returns 404. Link updated with a search result of more datasets.	4 years ago
Joshua Lumb	cf9b2b5fd1	detect-dsize: Add ! operator for dsize matching	4 years ago
myr463	755124763d	doc: escape dot in pcre	4 years ago
Shivani Bhardwaj	51be8f0238	doc/dcerpc: add proto keywords	4 years ago
showipintbri	a39025bf24	doc: Grammar Correction	4 years ago
Juliana Fajardini	6b8b58f98a	doc/eve: common fields and alert updates ... - update examples for both - change app_proto from alert field to common field, as per JsonBuilder's changes.	4 years ago
Juliana Fajardini	eacf933edf	doc/eve: fix typos	4 years ago
Philippe Antoine	95f225e8fb	doc: update sphinx api to use add_css_file ... instead of deprecated add_stylesheet	4 years ago
Jeff Lucovsky	fcd1ae3bf1	doc: Protocol name/case change for upgrade doc ... This commit adds a one-liner to the upgrade document for 7.0 stating that protocol names/values are now builtin to Suricata and that names and their casing may change.	4 years ago
Simon Dugas	0ed62e93ec	doc/modbus: add eve logging documentation	4 years ago
frank honza	f83d51d0cb	ike: set event for multiple server proposals	4 years ago
Andreas Herz	a5f36eccf1	doc: add documentation for rawbytes keyword	4 years ago
frank honza	ab59ef0d79	ikev1: add documentation for ikev1	4 years ago
frank honza	ecdf9f6b0b	ikev1: rename ikev2 to common ike ... Renaming was done with shell commands, git mv for moving the files and content like find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.	4 years ago
Shivani Bhardwaj	d708744f2b	doc: fix ubuntu pkg name for tcmalloc	4 years ago
Jason Ish	560974b2db	doc/quickstart: use new test url that works ... Replace http://testmyids.org with http://testmynids.org/uid/index.html, as testmyids.org now always redirects to https.	4 years ago
Josh Stroschein	7ece0ac31f	doc: update installation documentation for CentOS and Fedora	4 years ago
Philippe Antoine	a04b5566a6	http: makes decompression time limit configurable	4 years ago
Jeff Lucovsky	25e9483168	doc/lua: Lua API name consistency ... This commit updates the documentation of the SCFlow* function names available to Lua scripts. Formerly, they used the prefix "Sc"; now they use "SC".	4 years ago
Jason Ish	547afcb983	doc/userguide/transforms: remove not about libnss being required	4 years ago
Jason Ish	41591af48b	doc/userguide/install: remove libnss	4 years ago
Jason Ish	4b9af8d2ce	doc/userguide: document --disable-hashing	4 years ago
Jason Ish	c0ddad8e7e	doc/ja3: libnss support no longer required	4 years ago
Kirby Kuehl	5499a6f7cd	doc: fix URL for unix-socket python example	4 years ago
Sascha Steinbiss	f78f444a5e	doc: build all manpages	4 years ago
Carl Smith	9b840104bd	lua: Make the rule action available to output scripts ... Useful for those that want to do custom logging from lua	4 years ago
Justin Ossevoort	320de5f43d	eve: Log tenant_id for all eve-json messages	4 years ago
Victor Julien	372fc26739	ci: buildbot is decommissioned, so remove prscript refs	4 years ago
Sascha Steinbiss	15c42e0d83	doc: add documentation for SRV DNS JSON structure	4 years ago
Philippe Antoine	096dce4bba	http2: allow filestore to work with HTTP2	4 years ago
Philippe Antoine	4e242645be	doc: explicit header normalization further ... And their concatenation as described in RFC 2616	4 years ago
Philippe Antoine	6b30890de9	doc: http.uri.raw has no spaces ... as they are in the protocol cf bug #2881	4 years ago
Victor Julien	7b4ac8dbab	doc/userguide: update http keywords	4 years ago
Victor Julien	ca47d75c80	doc/userguide: explain --strict-rule-keywords	4 years ago
Jeff Lucovsky	a18a9d3046	doc: New sticky buffer icmpv4.hdr	4 years ago
Phil Young	76de981574	napatech: Added comment indicating that hba will be deprecated ... HBA will be deprecated in Suricata 7	4 years ago
Jason Ish	3030a3da18	doc: provide eve 1 deprecation date	4 years ago
Victor Julien	c95850c6ce	doc/rules: document config rule option	4 years ago
Jeff Lucovsky	6f9b7e052a	doc/eve: Update threaded filename examples	4 years ago
Jason Ish	f70e1f571e	doc/userguide: add info about --set and lists	4 years ago
Jason Ish	69fffb2dc4	doc/userguide: include man page even when not including pdf ... Fix a mistake in Makefile.am where the man page was only being added to the distribution if the PDF was also created. It should be included even if the PDF cannot be included.	4 years ago
Shivani Bhardwaj	87617b200c	doc/datasets: add info about memcap and hashsize	5 years ago
Jason Ish	7d44e80a50	doc: document removal of unified2 ... And suggest an alternate tool, Meer if compatibility with Barnyard2 style databases is required. Redmine ticket: https://redmine.openinfosecfoundation.org/issues/3497	5 years ago
Jason Ish	e71f2b22fa	doc: add removal of individual json loggers ... Add link to multiple eve instances as a replacement for this feature.	5 years ago
Philippe Antoine	9b5c923327	http: disables lzma by default for HTTP	5 years ago
Victor Julien	e1ecb7dc41	doc/datasets: explain reloads, general improvements	5 years ago
Simon Dugas	48da18b081	doc: dns - document additional fields in eve event ... Documentation of additional fields for soa and sshfp. Also some minor doc fixes and updates.	5 years ago
Jeff Lucovsky	06f41f608c	doc: Improve grammar, spelling and clarifications ... This commit improves the overall documentation's grammar, spelling, and adds clarifications where needed.	5 years ago
jason taylor	b21160a6e3	doc: http.host keyword note for matching on port ... Signed-off-by: jason taylor <jtfas90@gmail.com>	5 years ago
Roland Fischer	de7c7eeff0	doc: Add dev code-style	5 years ago
Odin Jenseg	4549505418	doc/userguide: fix outdated xdp info	5 years ago
Philippe Antoine	999af4f62a	http2: adds documentation	5 years ago
James Dutrisac	8d5e54c046	pcap: recusively reading pcaps / documentation ... Changes to doc/userguide/partials/options.rst for feature 2363 (reading pcaps recursively)	5 years ago
Sascha Steinbiss	4e1a41a17d	output-json: add MAC address output ... This commit adds MAC address output to the EVE-JSON format. We follow the remarks made in Redmine ticket #962: for packets, log MAC src/dst as a scalar field in EVE; for flows, log MAC src/dst as lists in EVE. Field names are different between flow and packet context to avoid type confusion (src_mac vs. src_macs). Configuration approach and JSON representation is taken from previous GitHub PR #2700.	5 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	5 years ago
Jeff Lucovsky	a5d30a3220	doc/output: Document multithreaded eve option	5 years ago
Philippe Antoine	1569f3e349	transform: adds url_decode keyword ... Fixes https://redmine.openinfosecfoundation.org/issues/2689 Adds a new source file to handle this keyword. And modifies documentation, Makefile, and registration accordingly. url_decode decodes url-encoded data, ie replacing '+' with space and '%HH' with its value.	5 years ago
Victor Julien	00cc3c7374	eve/ssh: change hassh logging format ... Elastic search didn't accept the 'hassh' and 'hassh.string'. It would see the first 'hassh' as a string and split the second key into a object 'hassh' with a string member 'string'. So two different types for 'hassh', so it rejected it. This patch mimics the ja3(s) logging by creating a 'hassh' object with 2 members: 'hash', which holds the md5 representation, and 'string' which holds the string representation.	5 years ago
Tristan Fletcher	6cbb4d4909	doc: fix spelling in flowbits image	5 years ago
Victor Julien	e04d48c8c8	doc/userguide: fix outdated mpm info	5 years ago
Victor Julien	04d88e7012	doc/suricata-update: fix typo and do minor cleanups ... Thanks to showipintbri PR 4465.	5 years ago
Jeff Lucovsky	901fbae7b9	doc: Add byte_math documentation	5 years ago
Jeff Lucovsky	496306e6a9	doc: update stream-depth description	5 years ago
Jeff Lucovsky	ec07f58705	doc: update file-store stream depth description	5 years ago
Vadym Malakhatko	a80f705d4b	userguide: add documentation for Hassh usage ... 1. Rules keywords 2. Json keywords 3. Usage in lua 4. Enabling in configuration file	5 years ago
Jeff Lucovsky	b116a56a32	doc: Correct typos	5 years ago
Jeff Lucovsky	59cc3c6281	doc: Update byte_extract doc	5 years ago
Jeff Lucovsky	297f91479e	doc: Fix spelling error	5 years ago
Victor Julien	06f414d66d	doc/manpage: improve intro, add examples	5 years ago
Victor Julien	75727c05e0	doc/manpage: add --reject-dev option	5 years ago
Victor Julien	82ac72782d	doc/userguide: update app-proto list	5 years ago
Victor Julien	e6330c354d	doc/userguide: list valid rule actions	5 years ago
Jeff Lucovsky	5e4aa5b851	doc: Improve tos description ... This commit improves the description of the `tos` keyword by emphasizing that the value used should adhere to the guidelines in RFC2474. Instead of specifying the DSCP value directly, right shift the DSCP value and use that.	5 years ago
Jeff Lucovsky	3005dca3fd	doc: pcrexform documentation	5 years ago
Jason Ish	a77662bdbf	userguide: remove old drop-log documentation ... Redmine issue: https://redmine.openinfosecfoundation.org/issues/2381	5 years ago
Jason Ish	8997a114cb	userguide: RDP now enabled by default ... Redmine issue: https://redmine.openinfosecfoundation.org/issues/3255	5 years ago
Jason Ish	3eb0461abd	userguide: SIP now enabled by default ... Redmine issue: https://redmine.openinfosecfoundation.org/issues/3256	5 years ago
Victor Julien	d0526e71c0	doc/userguide: add IPS with BPF info, minor cleanups	5 years ago
Jason Ish	6b8320d1c0	doc: document file-store v1 to v2 configuration changes	5 years ago
Jason Ish	6850dbc852	suricata.yaml: remove filestore v1 configuration	5 years ago
Victor Julien	e5fd47dcfd	doc/devguide: create basic layout ... Issue: #3343	5 years ago
Jason Ish	0dd1b2a616	doc: typo: http.server_body should be http.response_body ... Thanks to Jason Williams for pointing this out.	5 years ago
Victor Julien	a611ae2102	doc/perf: minor improvements	5 years ago
Andreas Herz	1d9db2b5f9	doc: add performance analysis section	5 years ago
Sascha Steinbiss	5598ff5bb3	doc/install: refer to buster as Debian stable	5 years ago
Todd Mortimer	6b4d32c6bb	doc: Update documentation for by_rule and by_both thresholds.	5 years ago
Jeff Lucovsky	5f71e7a371	doc/devguide: Submission and style ... This commit adds code submission and coding style guidelines to the devguide. Most of the material is a straight port from the wiki but there have been some content modifications and additions.	5 years ago
Jason Ish	752e4828d7	devguide: include sources in EXTRA_DIST ... Required for distcheck to pass, and required to build docs from a dist archive.	5 years ago
Victor Julien	e97cdb48f3	decode/teredo: implement port support ... Implement support for limiting Teredo detection and decoding to specific UDP ports, with 3544 as the default. If no ports are specified, the old behaviour of detecting/decoding on any port is still in place. This can also be forced by specifying 'any' as the port setting.	5 years ago
Jeff Lucovsky	4ad6c5421a	doc: fix documentation typos	5 years ago
Jeff Lucovsky	bc01392e93	doc: Update byte_test documentation	5 years ago
Frank Honza	1c8943dedd	add RFB parser ... This commit adds support for the Remote Framebuffer Protocol (RFB) as used, for example, by various VNC implementations. It targets the official versions 3.3, 3.7 and 3.8 of the protocol and provides logging for the RFB handshake communication for now. Logged events include endpoint versions, details of the security (i.e. authentication) exchange as well as metadata about the image transfer parameters. Detection is enabled using keywords for: - rfb.name: Session name as sticky buffer - rfb.sectype: Security type, e.g. VNC-style challenge-response - rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ... The latter could be used, for example, to detect brute-force attempts on open VNC servers, while the name could be used to map unwanted VNC sessions to the desktop owners or machines. We also ship example EVE-JSON output and keyword docs as part of the Sphinx source for Suricata's RTD documentation.	5 years ago
Victor Julien	ccfdcb55fb	devguide: document new app-layer retvals	5 years ago
Philippe Antoine	6251deae21	doc: adds doc for ipv4.hdr signature keyword	5 years ago
Philippe Antoine	1cd314c500	detect: adds icmpv6.mtu keyword	5 years ago
Jeff Lucovsky	e14447d594	docs/napatech: Correct typo	5 years ago
Shivani Bhardwaj	c5cee05169	doc: Fix typo Generate -> Generator	5 years ago
Shivani Bhardwaj	7b1699c5a8	doc: Add chassis for dev docs ... Closes redmine ticket 3344.	5 years ago
Philippe Antoine	8396333493	detect: adds icmpv6.hdr keyword	5 years ago
Philippe Antoine	af1361a988	doc: add missing documentation for ipv6.hdr keyword	5 years ago
Jason Ish	d3f6a95b56	doc: removed unified2 output	5 years ago
Jeff Lucovsky	8c132c0b87	doc: Correct RST quote usage ... Corrects misplaced backticks preventing proper formatting of `mpm-algo` section.	5 years ago
Jeff Lucovsky	3385859176	doc/userguide: Update for dump-features	5 years ago
Phil Young	3fbcacf9a8	napatech: documentation hardware based bypass support ... Napatech hardware bypass support enables Suricata to utilize capabilities of Napatech SmartNICs to selectively bypass flow-based traffic.	5 years ago
Shivani Bhardwaj	700eebaecc	doc/conf: Update copyright and regex for version ... Make the new regex in compliance with the modern autoconf syntax. Closes redmine ticket #3423	5 years ago
jason taylor	1666bc0ad1	doc: minor capitalization fix ... Signed-off-by: jason taylor <jtfas90@gmail.com>	5 years ago
jason taylor	4f7dc4f136	doc: add bsize documentation and rule example ... Signed-off-by: jason taylor <jtfas90@gmail.com>	5 years ago
Daisu	fccdb1c642	doc/commandline: -i option is useable several times	5 years ago
Steven Hostetler	4ac5ab00b7	doc/install: fix geoip typo	5 years ago
Victor Julien	411dd69e92	doc/eve: layout and formatting fixes	5 years ago
Jason Williams	55a36c79ff	doc: update http keywords documentation	5 years ago
jason taylor	95237f9894	docs: update datasets examples ... Signed-off-by: jason taylor <jtfas90@gmail.com>	5 years ago
EmilienCourt	50bb8d4cb2	doc: fix typo on example ... Quotes have been forgotten in the dnp3.data example, which throws an SC_ERR_INVALID_SIGNATURE(39) if used like in the example.	5 years ago
Eric Leblond	9ef2f81ee7	doc/userguide: fix typo	5 years ago
Eric Leblond	821d590f5b	doc/userguide: fix base64 example ... Add a sticky buffer example and fix the content modifier one.	5 years ago
Pascal Delalande	8e6a2bd42e	doc: removal of disable-rust and path typo for suricatasc	5 years ago
Victor Julien	d5ae68afc2	doc: fix version in install doc	5 years ago
Victor Julien	1c27a99827	doc: add upgrade page	5 years ago
Jason Ish	718fcbb682	doc: document eve/dns v2 as the default ... Adds eve/dns v2 format documentation. Update legacy format to require the version field.	5 years ago
Philippe Antoine	6921608673	http: updates suricata.yaml comments ... As well as the userguide documentation about suricata.yaml	5 years ago
Jason Ish	9111b9df57	doc: cleanup enging logging ... Attempt cleanup the engine logging a bit. Also a include a verbatim excerpt of the default configuration here for reference purposes.	5 years ago
Jason Ish	c97195bf0b	doc: -v verbose option documentation update ... Update -v documentation to reflect the new behaviour discussed in bug #1851 where -v changes the log level to fixed levels instead of an offset of the default log level configured in suricata.yaml.	5 years ago
Konstantin Klinger	808ea0dba9	app-layer: remove obsolete msn protocol detection	5 years ago
Victor Julien	6d2bd6607e	datasets: make clear the feature is experimental	5 years ago
Jeff Lucovsky	17c3e22ecd	doc/eve.alert: Expand metadata description	5 years ago
Victor Julien	4061bf5ceb	doc/datasets: update example config to map	5 years ago
Victor Julien	029683cbac	doc: reformat linux ips guide	5 years ago
Eric Leblond	6d9416148b	doc: add nftables IPS configuration	5 years ago
Eric Leblond	82eb669205	doc: information about scaling AF_PACKET IPS mode	5 years ago
Eric Leblond	ffe81dc9f2	doc: add info about AF_PACKET IPS ... Based on https://home.regit.org/2012/09/new-af_packet-ips-mode-in-suricata/ Also fix some typo in Netfilter setup.	5 years ago
Jason Ish	0cd5452194	doc: mark independent json loggers as deprecated ... This is the loggers such as alert-json-log, dns-json-log, etc. They are not even referenced in the default configuration file, and are easily replaced with multiple eve instances.	5 years ago
Jason Ish	212252faf2	doc/drop.log: mark as deprecated and scheduled to be removed ... Also make sure options are in sync with those in suricata.yaml.	5 years ago
Jason Ish	5345379d14	doc/unified2: add deprecation/removal notice	5 years ago
Jason Ish	873bc290bc	doc/filestore(v1) - make deprecation text a note ... Highlights that is is deprecated in the HTML output.	5 years ago
Jason Ish	7f32822843	doc/filestore(v1) - document force-filestore field	5 years ago
Jeff Lucovsky	44a59b78c7	doc/anomaly Remove event_no	5 years ago
Victor Julien	be6cdd37f8	stream: remove fix stream.depth references	5 years ago
Peter Manev	10819ed892	doc: Update tuning considerations doc	5 years ago
Peter Manev	6df1001957	doc: Update high performance config doc	5 years ago
Victor Julien	bd2f1e15fd	doc/stats: minor clarrifications on 5.0 defaults	6 years ago
Victor Julien	42438ec08e	doc/userguide: add quickstart to dist	6 years ago
Giuseppe Longo	dd5d0afd79	doc: add SIP keywords	6 years ago
Jason Ish	d3e2cc9926	doc: document dns.opcode keyword	6 years ago
Jason Ish	daed788d49	doc: Replace dns_query with dns.query.	6 years ago
Giuseppe Longo	972be0a560	doc: update file-extraction section	6 years ago
Travis Green	798d874662	doc: fix whitespace	6 years ago
Victor Julien	6aa2d550a1	doc/dotprefix: fix example rules	6 years ago
Jeff Lucovsky	ab3d6328ba	detect/transform: add dotprefix keyword to doc	6 years ago
Victor Julien	df325d63ea	doc/eve.anomaly: fix indent and general formatting	6 years ago
Jeff Lucovsky	075592b66f	doc: Simplified anomaly configuration settings	6 years ago
Jeff Lucovsky	aaacbf28c2	logging/anomaly: Support configuration filter types	6 years ago
Eric Leblond	35bc73e4e2	doc: change eBPF directory path	6 years ago
Zach Kelly	caef8b5b38	protocol parser: rdp ... Initial implementation of feature 2314: 1. Add protocol parser for RDP 2. Add transactions for RDP negotiation 3. Add eve logging of transactions	6 years ago
Andreas Herz	d657fd9bf0	doc: add quickstart guide	6 years ago
Victor Julien	d5009c5d8c	doc/stream: briefly explain bypass	6 years ago
Jason Ish	0bb07b550c	userguide: remove section on using Oinkmaster ... Users should be using Suricata-Update now.	6 years ago
Travis Green	3f146cdd7e	doc: add endswith keyword docs	6 years ago
Travis Green	9f8dcad287	doc: update of ssh-kewords documentation ... Modifies ssh-keywords.rst to fix syntax error in example rule as well as update descriptions to indicate older keywords have been deprecated.	6 years ago
Jason Ish	9488002a0d	doc: use describe instead of option for old Sphinx ... Older versions of Sphinx will generate duplicate IDs when you have options like: .. option:: some-option .. option:: some-other-option The version of Sphinx provided on CentOS 7 has this issue, newer versions of Sphinx do not. As CentOS 7 is still a popular distribution, change ".. option" to ".. describe" which has the same visual output, but does not generate links.	6 years ago
Victor Julien	e36a963196	datasets/doc: minor fixes and clarifications	6 years ago
Victor Julien	0107b9a057	doc/dataset: initial documentation	6 years ago
Victor Julien	1bc738fbe4	doc: typo fixes ... By @espritlibre and @Zeal0us	6 years ago
Nick Price	d0a85b7550	ja3: Mention LibNSS dependency for JA3	6 years ago
Eric Leblond	cc28d24e9a	doc: install eBPF files in share directory ... Following proposal by Sascha Steinbiss, let's use /usr/share/suricata to store the eBPF files.	6 years ago
Eric Leblond	3cf49ae868	doc: fix English and some typos	6 years ago
Eric Leblond	4be6701836	doc: pointer to bpfctrl ... As bpfctrl is currently the easiest way to manage pinned maps, let's point to it. We will switch doc to suricatacl once support has been added.	6 years ago
Eric Leblond	8f1a7de791	doc: improve doc on compiling with eBPF support	6 years ago
Eric Leblond	f1ab27b7cb	doc: improve XDP cpu redirect documentation	6 years ago
Eric Leblond	6d9ac64f7b	doc: only balance by ip pair ... As there is some issue with defrag, let's recommend to only do IP pair load-balacing for RSS	6 years ago
Eric Leblond	a1d3835b86	doc: document filter.bpf changes ... Also adds some info to explain maps.	6 years ago
Eric Leblond	08397e07f1	doc: fix typos in geoip doc	6 years ago
Eric Leblond	0d5608bab2	doc: fix display of icmp code and type array	6 years ago
Eric Leblond	0c84591afe	doc: use a table to list direction filter in geoip	6 years ago
Eric Leblond	c01cadbade	doc: fix geoip syntax ... Spaces are not allowed before country code.	6 years ago
Vinjar Hillestad	4c18fee3c6	Documenting base64_decode and base64_content ... base64 doc changes based on #4027 pull feedback	6 years ago
Hilko Bengen	36998ab4cd	Add documentation for --with-clang parameter	6 years ago
Andreas Herz	c0bddff078	userguide: remove old reference to rule-reload option	6 years ago
Jeff Lucovsky	a66383569c	userguide: formatting: remove tabs	6 years ago
Jeff Lucovsky	c68510437f	userguide: ftp formatting updates	6 years ago
Jeff Lucovsky	2149807bd6	eve/ftp: Transaction support for unmatched requests ... Modified transaction logic to create a new transaction with each request; replies location transactions by using the oldest "open" (unmatched) transaction or the last transaction if none are open.	6 years ago