70 Commits (201b3a6001a64df6527f37dd298e0933ca0646bf)

Author	SHA1	Message	Date
Juliana Fajardini	08e928988f	flow/output: log triggered exception policies ... To accompany the Exception Policy stats, also add information about any Exception Policy triggered and for which target to the flow log event. Task #6215	1 year ago
Jason Ish	6ae5ae701b	doc/userguide: generate eve documentation ... Add EVE documentation for QUIC and Pgsql to their respective sections of the userguide. Also add a complete EVE reference as an appendix. Other protocols can be done, but its a manual process to document in the schema, then add the glue to pull them into the documentation. The documentation is generated during "make dist", or if it doesn't exist, "conf.py" will attempt to generate the eve documentation for building on Readthedocs.	2 years ago
Sascha Steinbiss	cb14e44780	userguide: fix spelling of `security_result` EVE field ... This ensures that the correct spelling of the `security_result` EVE field for RFB (as opposed to `security-result`) is also reflected in the documentation. Ticket: #7210	2 years ago
Jason Ish	4d3d57249a	doc: update dns section of the eve format documentation	2 years ago
Victor Julien	c79a382e42	eve/tls: log ALPN for client and server ... Part of the extended logging. Logs `client_alpns` and `server_alpns` arrays in the tls object. Ticket: #7055.	2 years ago
Giuseppe Longo	8a171c9d74	doc: add arp changes	2 years ago
Sascha Steinbiss	120313f4da	ja4: implement for TLS and QUIC ... Ticket: OISF#6379	2 years ago
Juliana Fajardini	bba3d4fc63	userguide/eve: explain pgsql requests & responses ... Add a more visible explanation of that requests, responses, frontend and and backend are, in Pgsql context, to avoid having to repeat that over different portions of the docs.	3 years ago
Juliana Fajardini	30ac77ce65	pgsql: add cancel request message ... A CanceldRequest can occur after any query request, and is sent over a new connection, leading to a new flow. It won't take any reply, but, if processed by the backend, will lead to an ErrorResponse. Task #6577	3 years ago
Juliana Fajardini	7dcc2e7a71	doc/eve-format: break pgsql section to char limit	3 years ago
Juliana Fajardini	a649a92afd	userguide: update tls not_after/not_before mentions ... Our tls fields not_after and not_before are actually logged as `notafter` and `notbefore`, but were documented with the underscore. Update the documentation, since updating the log format itself would be a breaking change. Task #5494	3 years ago
Juliana Fajardini	58fb559594	userguide: document flow_id, with examples ... Flow_id explanation expanded from version shared by Peter Manev. Task #6445	3 years ago
Juliana Fajardini	9900bdc162	userguide/eve: format and reorganize alert section ... The `field action` portion seemed to be comprised of a more generic section that followed it. Also formatted the section for lines to be within the character limit.	3 years ago
Philippe Antoine	9287cbc33a	http: logs custom headers in a subobject ... This subobject is request_headers or response_headers This especially avoids json keys collisions. Ticket: #5320 Also fixes typo referrer/referer	3 years ago
Victor Julien	c0d9b3c078	doc/userguide: spelling	3 years ago
Lancer Cheng	6142593a69	doc: add version filed in NTLMSSP documentation ... Bug OISF#5783	3 years ago
jason taylor	8e5b1fe8e6	userguide: add DHCP EVE log information ... Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Jason Ish	9d653512f9	doc/userguide: update bittorrent-dht eve examples ... Update the bittorrent-dht examples using real log records with peers and nodes broken down into objects.	4 years ago
Jason Ish	065f3ab9f1	doc: rename bittorrent-dht to bittorrent_dht in eve output	4 years ago
Aaron Bungay	d166c48d28	docs: update for bittorrent-dht app-layer	4 years ago
Lukas Sismis	e101384e7b	transversal: remove suricata-ids.org references	4 years ago
Eric Leblond	6f06f7c22c	doc: add info about capture_file key	4 years ago
Juliana Fajardini	579d7dcc01	pgsql: add initial support ... - add nom parsers for decoding most messages from StartupPhase and SimpleQuery subprotocols - add unittests - tests/fuzz: add pgsql to confyaml Feature: #4241	5 years ago
Emmanuel Thompson	9ad60e7661	doc/quic: Add quic to eve json format	5 years ago
Odin Jenseg	2a5d79e426	doc/eve-json-format/dns: Describing Z-bit	5 years ago
Juliana Fajardini	6b8b58f98a	doc/eve: common fields and alert updates ... - update examples for both - change app_proto from alert field to common field, as per JsonBuilder's changes.	5 years ago
Juliana Fajardini	eacf933edf	doc/eve: fix typos	5 years ago
Simon Dugas	0ed62e93ec	doc/modbus: add eve logging documentation	5 years ago
frank honza	f83d51d0cb	ike: set event for multiple server proposals	5 years ago
frank honza	ab59ef0d79	ikev1: add documentation for ikev1	5 years ago
Sascha Steinbiss	15c42e0d83	doc: add documentation for SRV DNS JSON structure	6 years ago
Simon Dugas	48da18b081	doc: dns - document additional fields in eve event ... Documentation of additional fields for soa and sshfp. Also some minor doc fixes and updates.	6 years ago
Philippe Antoine	999af4f62a	http2: adds documentation	6 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	6 years ago
Victor Julien	00cc3c7374	eve/ssh: change hassh logging format ... Elastic search didn't accept the 'hassh' and 'hassh.string'. It would see the first 'hassh' as a string and split the second key into a object 'hassh' with a string member 'string'. So two different types for 'hassh', so it rejected it. This patch mimics the ja3(s) logging by creating a 'hassh' object with 2 members: 'hash', which holds the md5 representation, and 'string' which holds the string representation.	6 years ago
Vadym Malakhatko	a80f705d4b	userguide: add documentation for Hassh usage ... 1. Rules keywords 2. Json keywords 3. Usage in lua 4. Enabling in configuration file	6 years ago
Frank Honza	1c8943dedd	add RFB parser ... This commit adds support for the Remote Framebuffer Protocol (RFB) as used, for example, by various VNC implementations. It targets the official versions 3.3, 3.7 and 3.8 of the protocol and provides logging for the RFB handshake communication for now. Logged events include endpoint versions, details of the security (i.e. authentication) exchange as well as metadata about the image transfer parameters. Detection is enabled using keywords for: - rfb.name: Session name as sticky buffer - rfb.sectype: Security type, e.g. VNC-style challenge-response - rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ... The latter could be used, for example, to detect brute-force attempts on open VNC servers, while the name could be used to map unwanted VNC sessions to the desktop owners or machines. We also ship example EVE-JSON output and keyword docs as part of the Sphinx source for Suricata's RTD documentation.	6 years ago
Victor Julien	411dd69e92	doc/eve: layout and formatting fixes	7 years ago
Jeff Lucovsky	44a59b78c7	doc/anomaly Remove event_no	7 years ago
Jeff Lucovsky	075592b66f	doc: Simplified anomaly configuration settings	7 years ago
Zach Kelly	caef8b5b38	protocol parser: rdp ... Initial implementation of feature 2314: 1. Add protocol parser for RDP 2. Add transactions for RDP negotiation 3. Add eve logging of transactions	7 years ago
Jeff Lucovsky	a66383569c	userguide: formatting: remove tabs	7 years ago
Jeff Lucovsky	c68510437f	userguide: ftp formatting updates	7 years ago
Jeff Lucovsky	2149807bd6	eve/ftp: Transaction support for unmatched requests ... Modified transaction logic to create a new transaction with each request; replies location transactions by using the oldest "open" (unmatched) transaction or the last transaction if none are open.	7 years ago
Jeff Lucovsky	1930b1f504	eve/ftp: Log FTP transactions ... This changeset includes changes that 1. Add transaction support to the FTP parser 2. Support eve json logging of FTP transactions	7 years ago
Jeff Lucovsky	6cd39c5cfb	userguide: Document app-layer anomaly items ... This changeset expands the anomaly section to include newly added app-layer items.	7 years ago
Eric Leblond	dbf3606169	doc: document flow event_type	7 years ago
Mats Klepsland	800608ab65	userguide: add JA3S fields to the TLS logger documentation	7 years ago
Jeff Lucovsky	8a94b93b7b	doc: Anomaly logging documentation ... This changeset adds discussion of anomaly log records and the anomaly log record format.	7 years ago
Pascal Delalande	bde65467a9	doc: add ssh protocol in eve log section	7 years ago