Commit Graph

17745 Commits (3c98ea85d69c288acdcab3d1fd83cf7fd071f797)
 

Author SHA1 Message Date
Eric Leblond 639eb70dda detect/pcre: add needed casts 1 year ago
Eric Leblond f747a3a001 datajson: add needed cast 1 year ago
Eric Leblond cff2198ef3 datajson: fix include in header 1 year ago
Eric Leblond 6e0cad33cb detect: remove some useless tests 1 year ago
Eric Leblond 751f3eef3b doc/userguide: fix some typos 1 year ago
Eric Leblond a297fd029a packet: optimize json context cleaning
We don't need to recycle the full alert array. This is going to
optimize packet recycle time.
1 year ago
Eric Leblond 1deca14331 decode: light refactor on packet cleaning 1 year ago
Eric Leblond 8425eed8cd datasets: improve lock handling
DatasetGetOrCreate should now be called with the dataset lock
hold so the lock management is easier to read.
1 year ago
Eric Leblond 131bfb9679 detect/dataset: fix locking on datajson 1 year ago
Eric Leblond cf7dda354e detect/dataset: check context_key validity
As context_key is an user entry and as it is used to build the JSON
string of alert, we could end up with an invalid event if the string
contains improper characters.
1 year ago
Eric Leblond 803d61c9d1 eve/alert: add comment about string format 1 year ago
Eric Leblond 0f172e721d detect/pcre: fix error handling 1 year ago
Eric Leblond ab5070c0e3 detect/engine: put datajson related code in a func 1 year ago
Eric Leblond e600f40f74 datasets: use SCLogError for errors 1 year ago
Eric Leblond 337472449a detect/engine: remove unused keyword 1 year ago
Eric Leblond cd07db83dc datasets: comment to specify usage of field 1 year ago
Eric Leblond be9e13c6b1 decode: use pointer for PacketContextData
By adding a pointer instead of the structure in the alert info
we spare some memory.
1 year ago
Eric Leblond 92f4b36e72 decode: rename ExtraDataJsonList 1 year ago
Eric Leblond b285894f69 datasets: comments about format 1 year ago
Eric Leblond 449d6fe607 datasets: rename function
DatasetCreateOrGet was in fact doing get or create.
1 year ago
Eric Leblond e0c5302df1 datasets: fix error handling in StringSet 1 year ago
Eric Leblond 9b6047ab3e datasets: factorize set operation 1 year ago
Eric Leblond 3880b8de22 datasjson: fix include barrier name 1 year ago
Eric Leblond be0f5dac0d detect/pcre: fix copyright date 1 year ago
Eric Leblond 43743b0fd3 datajson: key length fix
When using type string, we should not limit the size of the string.

This patch also fixes some implicit cast issues.
1 year ago
Eric Leblond 43a1ef45ca datajson: value_key is necessary in json format 1 year ago
Eric Leblond 6236574b9c doc/userguide: enrichment_key is now context_key 1 year ago
Eric Leblond 62e90206c6 datajson: rename enrichment_key to context_key 1 year ago
Eric Leblond 3e48342248 datajson: factorize code
Code was duplicated and a build error was reported so factorizing
was the best way to clean it.
1 year ago
Eric Leblond df99d29ee4 datajson: add sanity check on length
Also cast to avoid compilation error.
1 year ago
Eric Leblond cfa7a747c2 datajson: use systematic allocation 1 year ago
Eric Leblond d84d7431e4 datajson: more explicit memory handling 1 year ago
Eric Leblond 20a0575d96 doc/userguide: fix some typos
Suggestions from Juliana.

Co-authored-by: Juliana Fajardini Reichow <jufajardini@gmail.com>
1 year ago
Eric Leblond 23f643a4a7 eve/schema: fix ordering 1 year ago
Eric Leblond fed7ff1e76 datasets: remove comment about unused return value 1 year ago
Eric Leblond 79c8f431d0 datajson: simplify memory handling
DatajsonAdd function is now responsible of the handling of the mem
of datajsontype passed as argument.
1 year ago
Eric Leblond 606f7ba656 datajson: use wrapper 1 year ago
Eric Leblond 7e7bd92432 datajson: fix potential leak in error handling 1 year ago
Eric Leblond 4a420085b7 datajson: remove unnecessary abstraction 1 year ago
Eric Leblond 4cadeb17e1 github: upload scan-build artifacts 1 year ago
Eric Leblond d57e8731bd datajson: use more broadly supported formatter 1 year ago
Eric Leblond 7dc683e5d9 datajson: fix formatting 1 year ago
Eric Leblond c15bcbe9d6 datasets: factorize dataset creation
Factorize DatasetGet and DatajsonGet to only have the difference
between the two in the respective function.
1 year ago
Eric Leblond 28742871d2 datasets: separate DatasetGet in 2 functions
This will be used to factorize the code with datajson.
1 year ago
Eric Leblond b766bd9438 datasets/context: rename the datajson files
They are is renamed to datasets-context-json.* so we see that
it is about context and not about a new datasets type.
1 year ago
Eric Leblond 40c545f8d9 doc/userguide: jsonline is now standard ndjson 1 year ago
Eric Leblond f7dc2a71db datajson: rename jsonline to ndjson 1 year ago
Eric Leblond f724c75cc9 doc/userguide: improve datajson doc 1 year ago
Eric Leblond b03d4f8e1a datajson: output context to "context"
Using `alert.extra` was not really reflecting the nature of what
was added. So renaming it to `alert.context`.
1 year ago
Eric Leblond 0bc21eec48 datajson: fix thread safety violation 1 year ago