110 Commits (d99cbc5e0b0af692e413793fd3d678367c74ad77)

Author	SHA1	Message	Date
Philippe Antoine	9287cbc33a	http: logs custom headers in a subobject ... This subobject is request_headers or response_headers This especially avoids json keys collisions. Ticket: #5320 Also fixes typo referrer/referer	2 years ago
Victor Julien	c0d9b3c078	doc/userguide: spelling	2 years ago
Lancer Cheng	6142593a69	doc: add version filed in NTLMSSP documentation ... Bug OISF#5783	2 years ago
jason taylor	8e5b1fe8e6	userguide: add DHCP EVE log information ... Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
Jason Ish	9d653512f9	doc/userguide: update bittorrent-dht eve examples ... Update the bittorrent-dht examples using real log records with peers and nodes broken down into objects.	2 years ago
Jason Ish	065f3ab9f1	doc: rename bittorrent-dht to bittorrent_dht in eve output	2 years ago
Aaron Bungay	d166c48d28	docs: update for bittorrent-dht app-layer	2 years ago
Lukas Sismis	e101384e7b	transversal: remove suricata-ids.org references	2 years ago
Andreas Dolp	db73a12540	doc/tls: Add documentation for TLS logging	3 years ago
Andreas Dolp	f42bb45ccd	doc/tls: Remove redundant example	3 years ago
Eric Leblond	6f06f7c22c	doc: add info about capture_file key	3 years ago
Jason Ish	6ceeb08351	doc/userguide: updates for eve dns v1 removal ... Ticket: #4157	3 years ago
Juliana Fajardini	579d7dcc01	pgsql: add initial support ... - add nom parsers for decoding most messages from StartupPhase and SimpleQuery subprotocols - add unittests - tests/fuzz: add pgsql to confyaml Feature: #4241	3 years ago
Emmanuel Thompson	9ad60e7661	doc/quic: Add quic to eve json format	3 years ago
Odin Jenseg	2a5d79e426	doc/eve-json-format/dns: Describing Z-bit	3 years ago
Juliana Fajardini	7c636d25c7	userguide: (nit) fix typo in lua-output page	3 years ago
Juliana Fajardini	6b8b58f98a	doc/eve: common fields and alert updates ... - update examples for both - change app_proto from alert field to common field, as per JsonBuilder's changes.	4 years ago
Juliana Fajardini	eacf933edf	doc/eve: fix typos	4 years ago
Simon Dugas	0ed62e93ec	doc/modbus: add eve logging documentation	4 years ago
frank honza	f83d51d0cb	ike: set event for multiple server proposals	4 years ago
frank honza	ab59ef0d79	ikev1: add documentation for ikev1	4 years ago
Justin Ossevoort	320de5f43d	eve: Log tenant_id for all eve-json messages	4 years ago
Sascha Steinbiss	15c42e0d83	doc: add documentation for SRV DNS JSON structure	4 years ago
Jeff Lucovsky	6f9b7e052a	doc/eve: Update threaded filename examples	4 years ago
Jason Ish	7d44e80a50	doc: document removal of unified2 ... And suggest an alternate tool, Meer if compatibility with Barnyard2 style databases is required. Redmine ticket: https://redmine.openinfosecfoundation.org/issues/3497	5 years ago
Jason Ish	e71f2b22fa	doc: add removal of individual json loggers ... Add link to multiple eve instances as a replacement for this feature.	5 years ago
Simon Dugas	48da18b081	doc: dns - document additional fields in eve event ... Documentation of additional fields for soa and sshfp. Also some minor doc fixes and updates.	5 years ago
Philippe Antoine	999af4f62a	http2: adds documentation	5 years ago
Sascha Steinbiss	4e1a41a17d	output-json: add MAC address output ... This commit adds MAC address output to the EVE-JSON format. We follow the remarks made in Redmine ticket #962: for packets, log MAC src/dst as a scalar field in EVE; for flows, log MAC src/dst as lists in EVE. Field names are different between flow and packet context to avoid type confusion (src_mac vs. src_macs). Configuration approach and JSON representation is taken from previous GitHub PR #2700.	5 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	5 years ago
Jeff Lucovsky	a5d30a3220	doc/output: Document multithreaded eve option	5 years ago
Victor Julien	00cc3c7374	eve/ssh: change hassh logging format ... Elastic search didn't accept the 'hassh' and 'hassh.string'. It would see the first 'hassh' as a string and split the second key into a object 'hassh' with a string member 'string'. So two different types for 'hassh', so it rejected it. This patch mimics the ja3(s) logging by creating a 'hassh' object with 2 members: 'hash', which holds the md5 representation, and 'string' which holds the string representation.	5 years ago
Vadym Malakhatko	a80f705d4b	userguide: add documentation for Hassh usage ... 1. Rules keywords 2. Json keywords 3. Usage in lua 4. Enabling in configuration file	5 years ago
Frank Honza	1c8943dedd	add RFB parser ... This commit adds support for the Remote Framebuffer Protocol (RFB) as used, for example, by various VNC implementations. It targets the official versions 3.3, 3.7 and 3.8 of the protocol and provides logging for the RFB handshake communication for now. Logged events include endpoint versions, details of the security (i.e. authentication) exchange as well as metadata about the image transfer parameters. Detection is enabled using keywords for: - rfb.name: Session name as sticky buffer - rfb.sectype: Security type, e.g. VNC-style challenge-response - rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ... The latter could be used, for example, to detect brute-force attempts on open VNC servers, while the name could be used to map unwanted VNC sessions to the desktop owners or machines. We also ship example EVE-JSON output and keyword docs as part of the Sphinx source for Suricata's RTD documentation.	5 years ago
Jason Ish	d3f6a95b56	doc: removed unified2 output	5 years ago
Victor Julien	411dd69e92	doc/eve: layout and formatting fixes	5 years ago
Jason Ish	718fcbb682	doc: document eve/dns v2 as the default ... Adds eve/dns v2 format documentation. Update legacy format to require the version field.	5 years ago
Jeff Lucovsky	17c3e22ecd	doc/eve.alert: Expand metadata description	5 years ago
Jason Ish	0cd5452194	doc: mark independent json loggers as deprecated ... This is the loggers such as alert-json-log, dns-json-log, etc. They are not even referenced in the default configuration file, and are easily replaced with multiple eve instances.	5 years ago
Jeff Lucovsky	44a59b78c7	doc/anomaly Remove event_no	5 years ago
Victor Julien	df325d63ea	doc/eve.anomaly: fix indent and general formatting	6 years ago
Jeff Lucovsky	075592b66f	doc: Simplified anomaly configuration settings	6 years ago
Jeff Lucovsky	aaacbf28c2	logging/anomaly: Support configuration filter types	6 years ago
Zach Kelly	caef8b5b38	protocol parser: rdp ... Initial implementation of feature 2314: 1. Add protocol parser for RDP 2. Add transactions for RDP negotiation 3. Add eve logging of transactions	6 years ago
Victor Julien	1bc738fbe4	doc: typo fixes ... By @espritlibre and @Zeal0us	6 years ago
Jeff Lucovsky	a66383569c	userguide: formatting: remove tabs	6 years ago
Jeff Lucovsky	c68510437f	userguide: ftp formatting updates	6 years ago
Jeff Lucovsky	2149807bd6	eve/ftp: Transaction support for unmatched requests ... Modified transaction logic to create a new transaction with each request; replies location transactions by using the oldest "open" (unmatched) transaction or the last transaction if none are open.	6 years ago
Jeff Lucovsky	1930b1f504	eve/ftp: Log FTP transactions ... This changeset includes changes that 1. Add transaction support to the FTP parser 2. Support eve json logging of FTP transactions	6 years ago
Jeff Lucovsky	6cd39c5cfb	userguide: Document app-layer anomaly items ... This changeset expands the anomaly section to include newly added app-layer items.	6 years ago