260 Commits (e1e24d6cb422d927df9e9f28ffedba21750d4f1d)

Author	SHA1	Message	Date
Victor Julien	e1e24d6cb4	eve/alert: add sub state output	4 days ago
Philippe Antoine	9c244c978a	snmp/detect: add snmp.trap_address keyword ... Ticket: 8486	5 days ago
Philippe Antoine	08b0adf09d	snmp/detect: add snmp.trap_oid keyword ... Ticket: 8485	5 days ago
Philippe Antoine	b84f26ef0a	jsonschema: add existing snmp keywords	5 days ago
Giuseppe Longo	ede1bce923	output/json: add sctp metadata to alerts ... Log SCTP-specific fields in the EVE JSON "sctp" object for alert events. Ticket #4251	1 month ago
Giuseppe Longo	21d35f6b37	decoder/sctp: extend decoder ... Extend the SCTP decoder to parse chunk headers after the 12-byte common header. Each chunk is validated for minimum header size and length consistency per RFC 4960 sec 3.2. Add SCTPChunkHdr and SCTPVars structs to track per-packet chunk metadata Add five new decoder events for protocol violations: - SCTP_CHUNK_TOO_SMALL: insufficient data for a chunk header - SCTP_CHUNK_LEN_INVALID: chunk length < 4 or exceeds packet - SCTP_INIT_CHUNK_NOT_ALONE: INIT/INIT_ACK bundled (RFC 4960 sec 6.10) - SCTP_INIT_WITH_NON_ZERO_VTAG: INIT with vtag != 0 (RFC 4960 sec 8.5.1) - SCTP_DATA_WITH_ZERO_VTAG: DATA chunk with vtag == 0 Ticket #4251	1 month ago
Giuseppe Longo	8f205bb34f	llmnr: implement logger ... This adds an LLMNR protocol logger that reuses existing DNS functions, following the same approach as the mDNS logger: - No grouped logging - Rdata is logged in a field that is named after the rdata type - Types are logged in lower case - Flags are logged as an array Ticket #8366	1 month ago
Victor Julien	90a837cef3	detect/firewall: update discarded logic ... Only count alert queue overflow here, not alerts in the queue after a drop.	2 months ago
Victor Julien	8572088b0f	eve/alert: firewall default policy logging improvements ... Add firewall.hook to indicate the hook that the policy was set on. Ticket: #8566.	2 months ago
Victor Julien	2d4f1968b8	detect/firewall: support alert in default app policy ... Support `alert` as a secondary action in app-layer firewall policies. To implement this a Signature object is created per policy that uses alert, and this is stored in a hash table. When the policy is applied the signature is looked up and used in the PacketAlert. Ticket: #8566.	2 months ago
Juliana Fajardini	8a8574b149	exceptions: add dedicated flow drop reason ... To better control stats counters.	2 months ago
Juliana Fajardini	312967f291	detect: add flow drop by firewall as drop reason ... To track flow drops triggered by the firewall. Add flow drop by firewall as drop reason. As part of Ticket #7699	2 months ago
Juliana Fajardini	0acb136b40	schema: expand stats.ips.replaced explanation ... As this is a less obvious counter.	2 months ago
Juliana Fajardini	5b488feef5	detect/firewall: add dedicated stats counters ... Add a `firewall` stats counter aggregator for all firewall-related stats. De-overload "detect.alert_queue_overflow", by adding "firewall.discarded_alerts" to account for discarded drops in Firewall mode. Add Debug statements for tracking corner cases where it can be difficult to know where a drop is coming from. Added counters: - stats.firewall.blocked - stats.firewall.accepted - stats.firewall.rejected - stats.firewall.drop_reason.default_app_policy - stats.firewall.drop_reason.default_packet_policy - stats.firewall.drop_reason.flow_drop - stats.firewall.drop_reason.pre_flow_hook - stats.firewall.drop_reason.pre_stream_hook - stats.firewall.drop_reason.rules - stats.firewall.discarded_alerts Ticket #7699	2 months ago
Jeff Lucovsky	cc6fbcd5dd	etc/schema: add missing ftp fields ... Add ftp detect keywords to metadata Issue: 7502, 7503, 7507, 7505, 7508, 7506	2 months ago
Jason Ish	029fd1be59	eve: add rule generation source to alert record ... When an alert is generated from firewall context, add an engine value of "fw", otherwise "td" (for threat detect). The engine field is only added when firewall mode is enabled. Ticket: #8456	2 months ago
Philippe Antoine	54c02e1301	stats: replace dashes by underscores in app-layer protocols ... Ticket: 6502 Forbid dashes in json keys for better use by processing tools	2 months ago
Philippe Antoine	d030ea7f29	output: rename reject-target to reject_target ... Ticket: 6502 Forbid dashes in json keys for better use by processing tools	2 months ago
Jason Ish	18f742fdbd	schema: map NTP fields to keywords	2 months ago
Jason Ish	713e4eb900	ntp: convert reference_id to buffer and add keyword ... Store the NTP reference ID as raw network-order bytes so it can be exposed as a sticky buffer and matched with payload keywords. The reference ID is often a 4 character string, or an IP address and not just an integer identifier. Updates the log reference ID to be a string of colon separated hex digits as this matches what tshark does. Ticket: #8488	3 months ago
Jason Ish	74bb525401	ntp: create tx for all modes; log version, mode and stratum ... Add logging for version, mode and stratum as these will be the first keywords we will add. Ticket: #8425	3 months ago
Jason Ish	31b967b089	ntp: add transaction logging ... Adds basic NTP transaction logging for the current supported message types. Includes small cleanups around reference ID. Ticket: #8425	3 months ago
Victor Julien	670fdabd32	detect/snmp: add snmp.trap_type keyword ... Implemented as a U8 integer keyword. Ticket: #8482.	3 months ago
Victor Julien	c94cb8e098	eve/schema: add snmp trap fields	3 months ago
Eric Leblond	e4e5413478	etc/schema: add http_request_body ... Ticket: 8161	4 months ago
Eric Leblond	97a0ad342b	etc/schema: match on http response body ... Matching on the HTTP response body is not really possible as it is a transformed version that can not be accessed via the signature language.	4 months ago
Jason Ish	3e9c726aa8	etc/schema: remove "optional" field ... The optional field has not been valid JSON schema field since we started using it, so remove it. All fields are optional unless marked as required.	4 months ago
Victor Julien	94c16d8915	eve/igmp: add schema support for alert records	4 months ago
Victor Julien	d652b7ef62	decoder/igmp: detect RGMP (RFC 3488) ... RGMP is a dialect of IGMP that uses the same protocol structure, but with some different values for the fields. Detect this and log it differently.	4 months ago
Victor Julien	1b7cc2b323	decoder/igmp: initial decoder support for IGMP ... Basic v1, v2 and v3 header validation. Ticket: #8262.	4 months ago
Philippe Antoine	0d714b9624	doc/jsonschema: remove non-existing email fields	5 months ago
Philippe Antoine	81cc007a11	doc/jsonschema: remove non-existent ldap field ... Probably a duplicate typo	5 months ago
Philippe Antoine	750ae52eac	doc/jsonschema: remove obsolete insert_list_fail field ... Ticket: 5267	5 months ago
Ofer Dagan	2371829bf1	schema: add threshold stats counters ... Add schema definitions for new threshold-related statistics: - bitmap_alloc_fail: Count of bitmap allocation failures - bitmap_memuse: Memory usage by detection_filter bitmaps - memcap: Memory cap for threshold hash table - memuse: Memory usage by threshold hash table Task #7928	6 months ago
Jeff Lucovsky	54bd8edf68	decode/ipv4: Create event on unknown protos ... Issue: 7146 Create an event when the IPv4 header contains an unknown IP protocol.	6 months ago
Philippe Antoine	dd6baccabd	src: doc: remove more double-space typos ... Found with git grep -E '[a-z] [a-z]'	6 months ago
Shivani Bhardwaj	0f92583702	flow: split elephant flow detection per dir ... The tracking for elephant flow is done per direction however, the flag was set on the flow whenever either of the directions crossed the rate-limit defined in the settings. Given that the tracking was already split, it makes sense to split the detection tracking per direction as well and allow user to have a better control via rule language.	7 months ago
Philippe Antoine	24405a7b76	doc: http fields in json schema ... Ticket: 6075	7 months ago
Philippe Antoine	2f39c8c099	jsonschema: remove obsolete http fields ... These were moved to array request_headers/response_headers Ticket: 6075	7 months ago
Philippe Antoine	cf88ed518c	jsonschema: check for duplicate keys ... Ticket: 6691 And fix the one duplicate found	7 months ago
Philippe Antoine	1df568300c	doc/jsonschema: use dnp3_func instead of its alias	8 months ago
Juliana Fajardini	331bc8aeac	schema: add descriptions to global memcaps/memuses ... For FTP, Host, IP Pair and HTTP. Related to Task #6434	8 months ago
Juliana Fajardini	2855574a2c	schema: add additional properties to stats.capture ... The `stats.capture` object may have different properties based on the capture method used. This adds the ones pertaining to AF_PACKET capture. Related to Task #6434	8 months ago
Juliana Fajardini	12e0e51864	schema: add desc for each main stats module ... Part of the schema documentation effort. Related to Task #6434	8 months ago
Juliana Fajardini	025ffa6135	schema: allow stats.stream event counters ... While the counters exist, they're not present in the schema, causing validation to fail if stats.stream-events is enabled. Task #7858	8 months ago
Juliana Fajardini	173fec81f8	schema/stats: flow_mgr is actually flow.mgr ... The schema accounts for a stats counters group that is a subgroup of the flows stats counters. Remove `flow_mgr`, thus.	8 months ago
Philippe Antoine	85fa894425	detect: dnp3.func is now a generic integer ... Ticket: 7889	8 months ago
Victor Julien	acb769291a	exception-policy: add 'reject-both' option ... Allow rejecting both sides of a connection. Has the same support as regular reject (which is essentially rejectsrc). Ticket: #5974.	9 months ago
Philippe Antoine	047f1c5080	doc: fix enip_command name in json schema ... enip.command is not a keyword nor an alias	9 months ago
Philippe Antoine	969739d067	detect: http2.errorcode is now a generic integer ... Ticket: 7889	9 months ago