suricata

Commit Graph

Author	SHA1	Message	Date
Ali Jad Khalil	5d955c1836	decode/geneve: Add Geneve decoding functionality These changes are in response to feature request 3063. Geneve is very similar to VXLAN, but uses a slightly different encapsulation scheme.	5 years ago
Jason Ish	5d5eef624b	suricata.yaml: mark http2 as experimental Make it clear that HTTP2 is experimental and disabled by default.	5 years ago
Philippe Antoine	1422b18a99	http2: initial support	5 years ago
Sascha Steinbiss	4e1a41a17d	output-json: add MAC address output This commit adds MAC address output to the EVE-JSON format. We follow the remarks made in Redmine ticket #962: for packets, log MAC src/dst as a scalar field in EVE; for flows, log MAC src/dst as lists in EVE. Field names are different between flow and packet context to avoid type confusion (src_mac vs. src_macs). Configuration approach and JSON representation is taken from previous GitHub PR #2700.	5 years ago
Victor Julien	5db1d9b841	eve/yaml: move mqtt down	5 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	5 years ago
Jeff Lucovsky	30ae98f658	output/json: Multi-threaded EVE logging support This commit modifies the JSON loggers with changes necessary to support multi-threaded EVE output. Each "thread-init" function sets up the per-thread log file context for subsequent calls to the JSON output to buffer function.	5 years ago
Shivani Bhardwaj	9f9670ebdc	logging: Add DCERPC logger	5 years ago
Jeff Lucovsky	a58fdcd41d	suricata.yaml.in: update stream-depth description	5 years ago
Vadym Malakhatko	a80f705d4b	userguide: add documentation for Hassh usage 1. Rules keywords 2. Json keywords 3. Usage in lua 4. Enabling in configuration file	5 years ago
Jason Ish	e26718aea3	drop-log: remove drop log (deprecated) Remove the old style line based drop log. Redmine issue: https://redmine.openinfosecfoundation.org/issues/2381	5 years ago
Jason Ish	6ce9b2972b	rdp: enable by default Redmine issue: https://redmine.openinfosecfoundation.org/issues/3255	5 years ago
Jason Ish	5a7ba62493	sip: enable by default Redmine issue: https://redmine.openinfosecfoundation.org/issues/3256	5 years ago
Jason Ish	6850dbc852	suricata.yaml: remove filestore v1 configuration	5 years ago
Victor Julien	1aaf9a80c5	decode/vxlan: minor yaml example clarrification	5 years ago
Victor Julien	e97cdb48f3	decode/teredo: implement port support Implement support for limiting Teredo detection and decoding to specific UDP ports, with 3544 as the default. If no ports are specified, the old behaviour of detecting/decoding on any port is still in place. This can also be forced by specifying 'any' as the port setting.	5 years ago
Frank Honza	1c8943dedd	add RFB parser This commit adds support for the Remote Framebuffer Protocol (RFB) as used, for example, by various VNC implementations. It targets the official versions 3.3, 3.7 and 3.8 of the protocol and provides logging for the RFB handshake communication for now. Logged events include endpoint versions, details of the security (i.e. authentication) exchange as well as metadata about the image transfer parameters. Detection is enabled using keywords for: - rfb.name: Session name as sticky buffer - rfb.sectype: Security type, e.g. VNC-style challenge-response - rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ... The latter could be used, for example, to detect brute-force attempts on open VNC servers, while the name could be used to map unwanted VNC sessions to the desktop owners or machines. We also ship example EVE-JSON output and keyword docs as part of the Sphinx source for Suricata's RTD documentation.	5 years ago
Jeff Lucovsky	0c5c2173bc	config: General typo and grammar cleanup	5 years ago
Jason Ish	76582e34c1	suricata.yaml/dns: removed unused settings Remove DNS settings global-memcap, state-memcap and request-flood. These have never been used in the Rust implementation of the DNS decoder.	5 years ago
Jason Ish	d86973b386	unified2: remove deprecated output unified2 Ticket 2385: https://redmine.openinfosecfoundation.org/issues/2385	5 years ago
Phil Young	1c99536945	napatech: add hardware based bypass support Napatech hardware bypass support enables Suricata to utilize capabilities of Napatech SmartNICs to selectively bypass flow-based traffic.	5 years ago
Philippe Antoine	4a2918e6b5	yaml: clarify comment about dump-all-headers Logs a warning if the value is unknown Fixes #2810	5 years ago
Jason Ish	16221c0b33	suricata.yaml/dns: small cleanups, not that default is v2 Note that the eve dns log format is version 2 by default. Make the value of commented out values their default. Update the comment on the types to better reflect what it does.	5 years ago
Philippe Antoine	6921608673	http: updates suricata.yaml comments As well as the userguide documentation about suricata.yaml	5 years ago
Konstantin Klinger	808ea0dba9	app-layer: remove obsolete msn protocol detection	5 years ago
Victor Julien	ebecaca7ea	eve/anomaly: enable by default Default config will only enable 'app-layer' type within the anomaly logger.	5 years ago
Victor Julien	514c7c1a04	yaml: minor improvements	5 years ago
Victor Julien	cec8067001	yaml: clean up 'autofp-scheduler' option	5 years ago
Jeff Lucovsky	883cad1a86	logging/anomaly: Clarify anomaly logging Clarify the description of the anomaly logging types.	5 years ago
Jeff Lucovsky	af615baaf7	logging/alert: Expand alert logging description Clarify the configuration requirements for alerts and http-body logging.	5 years ago
Victor Julien	788c9f8f11	tls/ja3: don't disable; allowing runtime enabling	5 years ago
jason taylor	e4156b2f89	config: update lzma size notes to match others Signed-off-by: jason taylor <jtfas90@gmail.com>	5 years ago
Jason Ish	6c2e9ac27c	suricata.yaml: mark drop.log as deprecated	5 years ago
Jason Ish	4e12984ac8	suricata.yaml: mark unified2 as deprecated	5 years ago
Jason Ish	d891a8cb79	config: remove all but a stub of file-store v1. Remove most of the file-store v1 configuration section and mark it as deprecated. Provide a link where to find the available options.	5 years ago
Victor Julien	be6cdd37f8	stream: remove fix stream.depth references	5 years ago
Philippe Antoine	af4f816204	http: sets compression bomb limit	6 years ago
Philippe Antoine	c09ad01836	http: disable lzma decompression from configuration	6 years ago
Victor Julien	8765839084	sip: disable output by default	6 years ago
Jason Ish	a45a2fa1fc	sip: disable by default in 5.0	6 years ago
Giuseppe Longo	edc2a583a9	rust/sip: add SIP logger	6 years ago
Giuseppe Longo	2e975a0481	rust/sip: add parser for SIP protocol	6 years ago
Jason Ish	4111272c88	config/anomaly: use enabled key word; cleanups The anomaly section was commented out, but the types sub object was not, which then attached the types keyword to the previous object. Instead keep "anomaly" enabled in the yaml (not commented out) and use the "enabled: no" to have it disabled by default. Additonally reformat the comments to be better viewed in 80 columns.	6 years ago
Jason Ish	61a6eaf330	htp/lzma: set limit from configuration Also use a default defined in Suricata, not libhtp.	6 years ago
Jeff Lucovsky	aaacbf28c2	logging/anomaly: Support configuration filter types	6 years ago
Victor Julien	c1b333c96e	rdp: disable eve.rdp by default	6 years ago
Jason Ish	664605b5f1	rdp: disable rdp by default for 5.0	6 years ago
Zach Kelly	caef8b5b38	protocol parser: rdp Initial implementation of feature 2314: 1. Add protocol parser for RDP 2. Add transactions for RDP negotiation 3. Add eve logging of transactions	6 years ago
Shivani Bhardwaj	59da7ae302	counters: Add new default for decoder events Set the new default for decoder events to `decoder.event` instead of the previously used `decoder`. Remove the corresponding warning for 5.0.	6 years ago
Victor Julien	d5009c5d8c	doc/stream: briefly explain bypass	6 years ago

1 2 3 4 5 ...

400 Commits (1ec6307d9d2da72a41ff1e0d20c0bb0fa413aa3e)