aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
9,038 Commits
7 Branches
155 Tags
195 MiB
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'd2142cf433'
${ noResults }
Commit Graph

9038 Commits (d2142cf4337985e190891eb3a9d8ddcc017fed58)
 

Author SHA1 Message Date
Mats Klepsland 195fa9d272 lua: add Ja3GetHash function 
Add Ja3GetHash() to return the content of the JA3 hash buffer from the
TLS session.

Example:

  function init (args)
      local needs = {}
      needs["protocol"] = "tls"
      return needs
  end

  function setup (args)
      filename = SCLogPath() .. "/ja3_hash.log"
      file = assert(io.open(filename, "a"))
  end

  function log (args)
      ja3_hash = Ja3GetHash()
      if ja3_hash == nil then
          return
      end

      file:write(ja3_hash .. "\n")
      file:flush()
  end

  function deinit (args)
      file:close()
  end

In the (useless) example above, each JA3 hash is logged to a log file.
 7 years ago
Mats Klepsland a357f52fa5 doc: add documentation for ja3_string keyword 7 years ago
Mats Klepsland 6e23ae230b detect: add (mpm) keyword ja3_string 
Match on JA3 string using ja3_string keyword, e.g:

alert tls any any -> any any (msg:"JA3 string test";
        ja3_string; content:"65-68-69-102"; sid:1;)
 7 years ago
Mats Klepsland 38cc6f595f doc: add documentation for ja3_hash keyword 7 years ago
Mats Klepsland 6c7aacce9e detect: add (mpm) keyword ja3_hash 
Match on JA3 hash using ja3_hash keyword, e.g:

alert tls any any -> any any (msg:"JA3 hash test";
        ja3_hash;
        content:"e7eca2baf4458d095b7f45da28c16c34";
        sid:1;)
 7 years ago
Mats Klepsland d4af90032e util-ja3: add function to check if JA3 is disabled 7 years ago
Mats Klepsland 0c16cd0120 app-layer-ssl: generate JA3 fingerprints 
Decode additional fields from the client hello packet and generate
JA3 fingerprints.
 7 years ago
Mats Klepsland 3f0dea582d app-layer-ssl: split function into multiple smaller functions 
Split 'TLSDecodeHandshakeHello' into smaller functions to make
it easier to read the code when the function grows in size.
 7 years ago
Victor Julien ea1e13cb00 smb: suppress notice messages 7 years ago
Pierre Chifflier 576b8ef722 SMB: simplify code 7 years ago
Pierre Chifflier cf5de0c58e SMB: use String::from_utf8_lossy in logging functions 7 years ago
Pierre Chifflier b5529e4ffb SMB: use kerberos-parser to extract Real and PrincipalName 7 years ago
Victor Julien 0dfb3f0e7f smb1: extract rename info from TRANS2 
Exclude TRANS2 from generic TX lookup bypass.
 7 years ago
Victor Julien 8eeda113c8 smb1: add parsing for RENAME command 7 years ago
Victor Julien 7b61f2c589 smb2: log renames 7 years ago
Victor Julien 15978d4e85 smb: if filename is missing, use '<unknown>' 7 years ago
Victor Julien c60decd678 rust/dns: default to eve log version 2 for rust 7 years ago
Jason Ish 27fd521420 eve/dns/v2: support eve/dns v2 in rust 7 years ago
Jason Ish 57d9574839 rust/json: expose more of jansson to rust 7 years ago
Jason Ish dfdfc478ab eve/dns-v2: only log responses for enabled types 
This changes the logic a bit for v2, checking the rrtype of the
query to see if the response should be logged.
 7 years ago
Jason Ish 769f972185 eve/dns-v2: log authorities as a list 
Log the authorities just like the answers, as a list under
the authorities key.
 7 years ago
Giuseppe Longo fb66d45754 doc: introduce dns compact logging 7 years ago
Giuseppe Longo 92db7be502 output-json-alert: add dns info 
This changes LogQuery and LogAnswer functions
returning a json object instead of writing it in a log file.
In this way it's possible to reuse them to add dns info
into an alert.

The following is an alert record with dns:

{
  "timestamp": "2017-07-31T15:01:17.885281+0200",
  "event_type": "alert",
  "src_ip": "8.8.8.8",
  ...
  "dns": {
    "query": [
      {
        "type": "query",
        "id": 25394,
        "rrname": "notifications.google.com",
        "rrtype": "A",
        "tx_id": 0
      }
    ],
    "answer": {
      "type": "answer",
      "id": 25394,
      "rcode": "NOERROR",
      "answers": [
        {
          "rrname": "notifications.google.com",
          "rrtype": "CNAME",
          "ttl": 3599,
          "rdata": "plus.l.google.com"
        },
        {
          "rrname": "plus.l.google.com",
          "rrtype": "A",
          "ttl": 299,
          "rdata": "216.58.205.174"
        }
      ]
    }
  }
}
 7 years ago
Giuseppe Longo 6231ffc110 output-json-dns: add json logging functions 
This adds some public functions needed to add
dns information when an alert is logged.
 7 years ago
Giuseppe Longo 756bed06a8 output-json-dns: add new output formats for v2 
This adds two new output formats that permits to reduce
the number of line logged for a dns answer because
actually an event is logged for each answer.
With this patch, only an event that contains all the answers
is logged.

The formats are named 'detailed' and 'grouped'.

The first format provides a list of answers with
the following fields:
- rrname
- rrdata
- ttl
- rdata

The second format provides a list of record data grouped
by their type.

The output below is an example of the formats:

{
  "timestamp": "2017-11-29T10:27:18.148282+0100",
  "flow_id": 268864910185905,
  "in_iface": "wlp2s0",
  "event_type": "dns",
  "src_ip": "192.168.1.254",
  "src_port": 53,
  "dest_ip": "192.168.1.176",
  "dest_port": 52609,
  "proto": "UDP",
  "dns": {
    "type": "answer",
    "id": 3654,
    "rcode": "NOERROR",
    "answers": [
      {
        "rrname": "wordpress.org",
        "rrtype": "A",
        "ttl": 544,
        "rdata": "66.155.40.249"
      },
      {
        "rrname": "wordpress.org",
        "rrtype": "A",
        "ttl": 544,
        "rdata": "66.155.40.250"
      }
    ],
    "grouped": {
      "A": [
        "66.155.40.249",
        "66.155.40.250"
      ]
    }
  }
}
 7 years ago
Giuseppe Longo 869b7c0e0c output-json-dns: add new configuration 
This patch adds a new configuration for dns,
introducing a "version" that permits to switch
between the new and old format to provide
backward compatibility.

The new configuration is made up of these new fields:
- version
- requests (query)
- response (answer)
- types (custom)
 7 years ago
David DIALLO c2236ea2b3 modbus: Support Unit Identifier 
When destination IP address does not suffice to uniquely identify
the Modbus/TCP device.

Some Modbus/TCP devices act as gateways to other Modbus/TCP devices
that are behind this gateways.
 7 years ago
Victor Julien 71742ed52b smb: share can't be <share_root> 7 years ago
Victor Julien bc193242ad smb1: add OPEN_ANDX command name for logging 7 years ago
Victor Julien 32b19fac99 smb2: don't log/track each READ/WRITE/etc 7 years ago
Victor Julien fb986abe81 smb: log file FID/GUID as fuid 7 years ago
Victor Julien 67f0e27ca4 smb: add smb records to fileinfo 7 years ago
Victor Julien 816bd022a6 smb1: improve non nt-status handling 
Support SRV error, with a couple of codes.
Rename statux field to status_code.
 7 years ago
Victor Julien 0519807639 smb1: ignore tree_id in session setup 7 years ago
Victor Julien 286c054472 smb: improve nbss/smb record detection 7 years ago
Victor Julien 7ab071a58d rust/smb: implement minimal record parsing in probing 7 years ago
Victor Julien ff398deda9 rust/smb: improve protocol detection 
Register both pattern based detection and probing parsers.
 7 years ago
Victor Julien 251a8e7deb smb: add smb to default eve-log config 7 years ago
Victor Julien 283be3cade smb2: break out ioctl handling 7 years ago
Victor Julien bf08285602 smb2: parse async records 7 years ago
Victor Julien 5c26020714 smb2: add ioctl transactions to log the funcs 7 years ago
Victor Julien 75265ec376 smb2: map ioctl funcs to names 
List is based on Wireshark's list.
 7 years ago
Victor Julien 7cd66516f0 smb: use formal MS names for disposition 7 years ago
Victor Julien f7ed749d4f smb: disable debug output 7 years ago
Victor Julien eed492547c smb1: extract server guid from negotiate 7 years ago
Victor Julien 6d56edc3de smb2: log client and server guid from negotiate 7 years ago
Victor Julien c56f5e11ca smb2: log share type 7 years ago
Victor Julien d75ebdb981 smb: log create empty filename as '<share_root>' like Bro does 7 years ago
Victor Julien fcbeab70a4 smb1: log create 'service' fields 7 years ago
Victor Julien 90e2abaac4 smb1: use generic string parsing for trans 7 years ago