28 Commits (35b03b4077c908251396f74fe0fb50e881b44e8e)

Author	SHA1	Message	Date
Jeff Lucovsky	a3a3ad8968	doc/output: EVE output buffering related settings	1 year ago
Sascha Steinbiss	285cc29ec0	redis: add automatic trimming support for streams	2 years ago
Sascha Steinbiss	d3d9f1c395	redis: implement XADD stream support ... Ticket: #7082	2 years ago
Jason Ish	cc519beb91	suricata.yaml: add missing custom tls fields ... Also update the suricata.yaml in the userguide.	2 years ago
Juliana Fajardini	d1d1c8cdac	doc/conf/yaml: replace underscore with dashes ... Use sed + regex to replace all occurrences of suricata.yaml terms that used underscore for their up-to-date dash version. Also search for such terms in the eve-log.yaml partials file, as that is referenced in the configuration section. commands used: sed -i 's/\(^ *[a-z]*\)_\([a-z]*:\)/\1-\2/g' sed -i 's/\(^ *[a-z]*\)_\([a-z]*\)_\([a-z]*:\)/\1-\2-\3/g' Some other instances were found manually. Task #7260	2 years ago
Jeff Lucovsky	8064847fc6	doc: Document reference config setting ... Issue: 4974	2 years ago
Philippe Antoine	e0fd59a20d	doc: state that payload-length includes the gaps	2 years ago
Sascha Steinbiss	53c62432c6	doc: update MQTT configuration	2 years ago
Philippe Antoine	c9ce43b31e	output: configurable payload_length field for alerts ... Ticket: 7098	2 years ago
Giuseppe Longo	8a171c9d74	doc: add arp changes	2 years ago
Juliana Fajardini	bb59124063	yaml: unify 0 stats counter config option terms ... When we added feature #5976 (72146b969), we overlook that we also have a config stats option for the human-readable stats logs to output 0 counters. Due to not seeing this before, we now have two different setting names for basically the same thing, but in different logs: - zero-valued-counters for EVE - null-values for stats.log This ensures we use the same terminology, and change the recently added one to `null-values`, as this one has been around for longer. Task #6962	2 years ago
Juliana Fajardini	72146b969c	eve/stats: allow hiding counters whose valued is 0 ... Some stats can be quite verbose if logging all zero valued-counters. This allows users to disable logging such counters. Default is still true, as that's the expected behavior for the engine. Task #5976	2 years ago
Victor Julien	c0d9b3c078	doc/userguide: spelling	3 years ago
Jason Ish	0ea9ba66d1	userguide/eve-log: remove mentions of requiring Rust ... Rust is required to build now.	4 years ago
Aaron Bungay	d166c48d28	docs: update for bittorrent-dht app-layer	4 years ago
frank honza	ecdf9f6b0b	ikev1: rename ikev2 to common ike ... Renaming was done with shell commands, git mv for moving the files and content like find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.	5 years ago
Jason Ish	3030a3da18	doc: provide eve 1 deprecation date	6 years ago
Jeff Lucovsky	6f9b7e052a	doc/eve: Update threaded filename examples	6 years ago
Jeff Lucovsky	a5d30a3220	doc/output: Document multithreaded eve option	6 years ago
Jeff Lucovsky	17c3e22ecd	doc/eve.alert: Expand metadata description	7 years ago
Jason Ish	75a018ead2	doc: remove autoconf replacement var for Rust ... Set to yes as Rust is always enabled now.	7 years ago
Jason Ish	fb85822730	dhcp: update user guide	8 years ago
Pierre Chifflier	6eb48e1e93	Add ikev2 to userguide	8 years ago
Giuseppe Longo	fb66d45754	doc: introduce dns compact logging	8 years ago
Jason Ish	74e036d09f	doc: update eve/alert/metadata configuration	9 years ago
Martin Natano	fe9cac5870	eve/alert: include rule text in alert output ... For SIEM analysis it is often useful to refer to the actual rules to find out why a specific alert has been triggered when the signature message does not convey enough information. Turn on the new rule flag to include the rule text in eve alert output. The feature is turned off by default. With a rule like this: alert dns $HOME_NET any -> 8.8.8.8 any (msg:"Google DNS server contacted"; sid:42;) The eve alert output might look something like this (pretty-printed for readability): { "timestamp": "2017-08-14T12:35:05.830812+0200", "flow_id": 1919856770919772, "in_iface": "eth0", "event_type": "alert", "src_ip": "10.20.30.40", "src_port": 50968, "dest_ip": "8.8.8.8", "dest_port": 53, "proto": "UDP", "alert": { "action": "allowed", "gid": 1, "signature_id": 42, "rev": 0, "signature": "Google DNS server contacted", "category": "", "severity": 3, "rule": "alert dns $HOME_NET any -> 8.8.8.8 any (msg:\"Google DNS server contacted\"; sid:43;)" }, "app_proto": "dns", "flow": { "pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 81, "bytes_toclient": 0, "start": "2017-08-14T12:35:05.830812+0200" } } Feature #2020	9 years ago
Eric Leblond	72c8cd67d5	doc: documentation update on metadata	9 years ago
Jason Ish	ab939f4aaa	doc: breakout eve-log section to a partial file ... Both the suricata.yaml and eve configuration sections included the eve-log section from suricata.yaml. First, sync these up with the actual suricata.yaml then break it out into its own file, so only one file needs to be kept in sync with the actual configuration file.	9 years ago