25 Commits (f5e2968f129737ccbd5f0ee8ae3776203714b229)

Author	SHA1	Message	Date
Frank Honza	1c8943dedd	add RFB parser ... This commit adds support for the Remote Framebuffer Protocol (RFB) as used, for example, by various VNC implementations. It targets the official versions 3.3, 3.7 and 3.8 of the protocol and provides logging for the RFB handshake communication for now. Logged events include endpoint versions, details of the security (i.e. authentication) exchange as well as metadata about the image transfer parameters. Detection is enabled using keywords for: - rfb.name: Session name as sticky buffer - rfb.sectype: Security type, e.g. VNC-style challenge-response - rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ... The latter could be used, for example, to detect brute-force attempts on open VNC servers, while the name could be used to map unwanted VNC sessions to the desktop owners or machines. We also ship example EVE-JSON output and keyword docs as part of the Sphinx source for Suricata's RTD documentation.	5 years ago
Giuseppe Longo	dd5d0afd79	doc: add SIP keywords	6 years ago
Victor Julien	0107b9a057	doc/dataset: initial documentation	6 years ago
Vinjar Hillestad	4c18fee3c6	Documenting base64_decode and base64_content ... base64 doc changes based on #4027 pull feedback	6 years ago
Pierre Chifflier	aa608e0ca2	SNMP: add the "snmp.version" detection keyword	6 years ago
jason taylor	fc54d750dd	doc: add bypass keyword documentation ... Signed-off-by: jason taylor <jtfas90@gmail.com>	6 years ago
Victor Julien	72dd4a5f92	doc/rules: initial transforms documentation	6 years ago
Mats Klepsland	e92fda37c9	doc: add documentation for SSH keywords	6 years ago
Pierre Chifflier	0bd81ff838	Add krb5_msg_type detection keyword	7 years ago
Mats Klepsland	38cc6f595f	doc: add documentation for ja3_hash keyword	7 years ago
Eric Leblond	f5ba4c231d	doc: update following ftp-data changes	7 years ago
Ralph Broenink	98a1ec490f	doc: Move IP reputation keyword to rules section	7 years ago
Ralph Broenink	722cff1862	doc: Restructure ToC ... * All sections up to 2 levels deep are now shown regardless of whether they are a separate page * Rename Xbits and Thresholding for more consistent naming * Minor adjustment in the Payload Keywords section	7 years ago
Ralph Broenink	a55a6cdb62	doc: Move flowint as integral part of flow keywords	7 years ago
Ralph Broenink	bb1bf2643d	doc: Move fast_pattern and prefilter to dedicated page	7 years ago
Ralph Broenink	fea037fda8	doc: Moved explanation of normalized buffers to rules introduction	7 years ago
David Wharton	8a53d49e81	doc: replacing snort-compatibility link ... The snort-compatibility.rst document is being replaced by differences-from-snort.rst. This commit updates the link.	8 years ago
Victor Julien	bc38cd5932	doc: initial xbits documentation	8 years ago
Victor Julien	56ffba9fd8	doc: initial app-layer keywords ... Document app-layer-protocol and make a start with app-layer-event.	9 years ago
Victor Julien	d80914d350	doc: move rule reload and adding rules into rule-management	9 years ago
Victor Julien	92b393ee9a	doc: include enip page	9 years ago
Victor Julien	a2d8cfb5d3	doc: reorder rule docs	9 years ago
Victor Julien	5bd906ae9f	doc: prefilter keyword and config	9 years ago
Victor Julien	7ad667f282	doc: move snort compat to rule chapter	9 years ago
Jason Ish	2751baae46	doc: rename from "sphinx" to "userguide"	9 years ago