42 Commits (e2aab10d29683f99da8dcb290467dd8622121c53)

Author	SHA1	Message	Date
Mats Klepsland	47a7ebbbc2	doc: add JA3 fields to the TLS logger documentation	7 years ago
Mats Klepsland	fb0bfb614f	doc: add documentation for Ja3GetString Lua function	7 years ago
Mats Klepsland	2514553098	doc: add documentation for Ja3GetHash Lua function	7 years ago
Giuseppe Longo	fb66d45754	doc: introduce dns compact logging	7 years ago
Victor Julien	50a182194a	eve: log pcap filename	7 years ago
Pascal Delalande	2e5b293afb	doc: update eve json output for DNS and HTTP	7 years ago
Jason Ish	74e036d09f	doc: update eve/alert/metadata configuration	7 years ago
Martin Natano	fe9cac5870	eve/alert: include rule text in alert output ... For SIEM analysis it is often useful to refer to the actual rules to find out why a specific alert has been triggered when the signature message does not convey enough information. Turn on the new rule flag to include the rule text in eve alert output. The feature is turned off by default. With a rule like this: alert dns $HOME_NET any -> 8.8.8.8 any (msg:"Google DNS server contacted"; sid:42;) The eve alert output might look something like this (pretty-printed for readability): { "timestamp": "2017-08-14T12:35:05.830812+0200", "flow_id": 1919856770919772, "in_iface": "eth0", "event_type": "alert", "src_ip": "10.20.30.40", "src_port": 50968, "dest_ip": "8.8.8.8", "dest_port": 53, "proto": "UDP", "alert": { "action": "allowed", "gid": 1, "signature_id": 42, "rev": 0, "signature": "Google DNS server contacted", "category": "", "severity": 3, "rule": "alert dns $HOME_NET any -> 8.8.8.8 any (msg:\"Google DNS server contacted\"; sid:43;)" }, "app_proto": "dns", "flow": { "pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 81, "bytes_toclient": 0, "start": "2017-08-14T12:35:05.830812+0200" } } Feature #2020	7 years ago
Eric Leblond	72c8cd67d5	doc: documentation update on metadata	7 years ago
Jason Ish	ab939f4aaa	doc: breakout eve-log section to a partial file ... Both the suricata.yaml and eve configuration sections included the eve-log section from suricata.yaml. First, sync these up with the actual suricata.yaml then break it out into its own file, so only one file needs to be kept in sync with the actual configuration file.	7 years ago
Pascal Delalande	80f2fbac6e	rust/tftp: eve logging with rust	7 years ago
Pascal Delalande	0c99338e07	doc: update docs for DNS flags logging	7 years ago
Julian	f27b4fc8fe	redis: support for rpush in list mode ... This adds a new redis mode rpush. Also more consistent config keywords orientated at the redis command: lpush and publish. Keeping list and channel config keywords for backwards compatibility	8 years ago
Jason Ish	59d69666ea	doc: add more details to log rotation doc	8 years ago
Jason Ish	92f15b7ffb	doc: move log rotation to output section	8 years ago
Eric Leblond	b763c7ec11	doc: document http-body logging	8 years ago
Eric Leblond	9e581436a7	doc: info about new config for alert events in EVE	8 years ago
Eric Leblond	ef88689f1e	doc: add app_proto to alert event	8 years ago
Eric Leblond	f4374ffd0b	doc: some more info about alert format	8 years ago
Victor Julien	71c6df1655	lua: add SCFlowId for getting the flow id	8 years ago
Victor Julien	f6e3755b5c	lua: extend SCFlowAppLayerProto ... Change SCFlowAppLayerProto to return 5 values: <alproto> <alproto_ts> <alproto_tc> <alproto_orig> <alproto_expect>: alproto: detected protocol alproto_ts: detected protocol in toserver direction alproto_tc: detected protocol in toclient direction alproto_orig: pre-change/upgrade protocol alproto_expected: expected protocol in change/upgrade Orig and expect are used when changing and upgrading protocols. In a SMTP STARTTLS case, orig would normally be set to "smtp" and expect to "tls".	8 years ago
Ray Ruvinskiy	7539973109	tls: logging for session resumption ... We assume session resumption has occurred if the Client Hello message included a session id, we have not seen the server certificate, but we have seen a Change Cipher Spec message from the server. Previously, these transactions were not logged at all because the server cert was never seen. Ticket: https://redmine.openinfosecfoundation.org/issues/1969	8 years ago
fooinha	36667ab8a1	doc: async mode for redis eve output ... async: true ## if redis replies are read asynchronously	8 years ago
Mats Klepsland	8b9f84bff2	doc: add documentation for date modifiers in eve-log	8 years ago
Mats Klepsland	37a12fe799	doc: add documentation for eve-log file rotation	8 years ago
fooinha	20d4d40051	log: tls custom format log	8 years ago
Mats Klepsland	7b1dae6251	doc: add documentation for Lua SCFlowTimestamps	8 years ago
Mats Klepsland	3b23387664	doc: add documentation for eve-log file permissions	8 years ago
Mats Klepsland	285b566205	doc: add documentation for TlsGetCertSerial Lua function	8 years ago
Mats Klepsland	ee9f822b8e	doc: add documentation for tls_cert_serial keyword	8 years ago
Mats Klepsland	e91bb09c91	doc: add documentation for TLS eve-log	8 years ago
Mats Klepsland	6a382259f8	doc: documentation for custom JSON flags in eve-log	8 years ago
Mats Klepsland	edbb035160	doc: add documentation for Lua SCFlowHasAlerts	8 years ago
Nicolas Thill	3750c15632	doc: add SCPacketTimestamp Lua function ... Signed-off-by: Nicolas Thill <ntl@p1sec.com>	9 years ago
Victor Julien	4126fd82a0	doc: small eve update: add dns	9 years ago
Victor Julien	aaf0fe4d29	doc: eve update	9 years ago
Jason Ish	cd4c9e73f8	doc: fix sphinx warnings ... This involved removing documents that were intentionally not referenced as they are not good candidates for the user guide.	9 years ago
Victor Julien	7011d8f34c	doc: remove/cleanup 'guides'	9 years ago
Jason Ish	6149b014ec	doc: shorten some paths to satisfy distcheck ... Long paths were being dropped from the source package.	9 years ago
Andreas Herz	7806ae8f57	docs: sync up to recent redmine	9 years ago
Andi	8e655cf107	eve-json-format: add newest version from the wiki ... This was added by pevma in the wiki, so should go into the sphinx doc as well.	9 years ago
Jason Ish	2751baae46	doc: rename from "sphinx" to "userguide"	9 years ago