Commit Graph

31 Commits (282dad79caed8b64cc2be8b0c20911642bcacd02)

Author SHA1 Message Date
Pascal Delalande 0c99338e07 doc: update docs for DNS flags logging 7 years ago
Julian f27b4fc8fe redis: support for rpush in list mode
This adds a new redis mode rpush. Also more consistent config keywords orientated at the redis command: lpush and publish.
Keeping list and channel config keywords for backwards compatibility
8 years ago
Jason Ish 59d69666ea doc: add more details to log rotation doc 8 years ago
Jason Ish 92f15b7ffb doc: move log rotation to output section 8 years ago
Eric Leblond b763c7ec11 doc: document http-body logging 8 years ago
Eric Leblond 9e581436a7 doc: info about new config for alert events in EVE 8 years ago
Eric Leblond ef88689f1e doc: add app_proto to alert event 8 years ago
Eric Leblond f4374ffd0b doc: some more info about alert format 8 years ago
Victor Julien 71c6df1655 lua: add SCFlowId for getting the flow id 8 years ago
Victor Julien f6e3755b5c lua: extend SCFlowAppLayerProto
Change SCFlowAppLayerProto to return 5 values:
<alproto> <alproto_ts> <alproto_tc> <alproto_orig> <alproto_expect>:

alproto: detected protocol
alproto_ts: detected protocol in toserver direction
alproto_tc: detected protocol in toclient direction
alproto_orig: pre-change/upgrade protocol
alproto_expected: expected protocol in change/upgrade

Orig and expect are used when changing and upgrading protocols. In a
SMTP STARTTLS case, orig would normally be set to "smtp" and expect
to "tls".
8 years ago
Ray Ruvinskiy 7539973109 tls: logging for session resumption
We assume session resumption has occurred if the Client Hello message
included a session id, we have not seen the server certificate, but
we have seen a Change Cipher Spec message from the server.

Previously, these transactions were not logged at all because the
server cert was never seen.

Ticket: https://redmine.openinfosecfoundation.org/issues/1969
8 years ago
fooinha 36667ab8a1 doc: async mode for redis eve output
async: true ## if redis replies are read asynchronously
8 years ago
Mats Klepsland 8b9f84bff2 doc: add documentation for date modifiers in eve-log 8 years ago
Mats Klepsland 37a12fe799 doc: add documentation for eve-log file rotation 8 years ago
fooinha 20d4d40051 log: tls custom format log 8 years ago
Mats Klepsland 7b1dae6251 doc: add documentation for Lua SCFlowTimestamps 8 years ago
Mats Klepsland 3b23387664 doc: add documentation for eve-log file permissions 8 years ago
Mats Klepsland 285b566205 doc: add documentation for TlsGetCertSerial Lua function 8 years ago
Mats Klepsland ee9f822b8e doc: add documentation for tls_cert_serial keyword 8 years ago
Mats Klepsland e91bb09c91 doc: add documentation for TLS eve-log 8 years ago
Mats Klepsland 6a382259f8 doc: documentation for custom JSON flags in eve-log 8 years ago
Mats Klepsland edbb035160 doc: add documentation for Lua SCFlowHasAlerts 8 years ago
Nicolas Thill 3750c15632 doc: add SCPacketTimestamp Lua function
Signed-off-by: Nicolas Thill <ntl@p1sec.com>
9 years ago
Victor Julien 4126fd82a0 doc: small eve update: add dns 9 years ago
Victor Julien aaf0fe4d29 doc: eve update 9 years ago
Jason Ish cd4c9e73f8 doc: fix sphinx warnings
This involved removing documents that were intentionally
not referenced as they are not good candidates for the
user guide.
9 years ago
Victor Julien 7011d8f34c doc: remove/cleanup 'guides' 9 years ago
Jason Ish 6149b014ec doc: shorten some paths to satisfy distcheck
Long paths were being dropped from the source package.
9 years ago
Andreas Herz 7806ae8f57 docs: sync up to recent redmine 9 years ago
Andi 8e655cf107 eve-json-format: add newest version from the wiki
This was added by pevma in the wiki, so should go into the sphinx doc as well.
9 years ago
Jason Ish 2751baae46 doc: rename from "sphinx" to "userguide" 9 years ago