304 Commits (7ce77f93515c60949394c2a0e735a92dd2404d31)

Author	SHA1	Message	Date
Pascal Delalande	80f2fbac6e	rust/tftp: eve logging with rust	7 years ago
Pascal Delalande	0ff60f65ec	doc: update filestore for file hash extraction ... Update for extraction based on md5, sha1 and sha256	7 years ago
Victor Julien	07738af868	detect/content: introduce startswith modifier ... Add startswith modifier to simplify matching patterns at the start of a buffer. Instead of: content:"abc"; depth:3; This enables: content:"abc"; startswith; Especially with longer patterns this makes the intention of the rule more clear and eases writing the rules. Internally it's simply a shorthand for 'depth:<pattern len>;'. Ticket https://redmine.openinfosecfoundation.org/issues/742	7 years ago
Jason Ish	5420c0ab06	doc: document file-store v2	7 years ago
Victor Julien	746638b220	cuda: remove ... Remove CUDA support as it has been broken for a long time. Ticket #2382.	7 years ago
Eric Leblond	24f745553c	doc: update file extraction document ... Define the list of protocol parsers supporting extraction in one single place following Andreas Herz' suggestion.	7 years ago
Eric Leblond	f5ba4c231d	doc: update following ftp-data changes	7 years ago
Giuseppe Longo	70695201f6	doc: add memcap commands in unix-socket section	7 years ago
Eric Leblond	3bf098e52f	doc: document log reopen unix socket command	7 years ago
Victor Julien	be9ec3958e	doc: initial suricata-update page	7 years ago
Andreas Herz	6f0794c16f	keyword-filesize: add units	7 years ago
Dana Helwig	3ab9120821	source-pcap-file: Pcap Directory Mode (Feature #2222) ... https://redmine.openinfosecfoundation.org/issues/2222 Pcap file mode that when passed a directory will process all files in that directory. If --pcap-file-continuous or continuous option is passed in json, the directory will be monitored until the directory is moved/deleted, suricata is interrupted, or the pcap-interrupt command is used with unix command socket. Existing file implementation and new directory implementation has moved from source-pcap-file into pcap-file-helper and pcap-directory-helper. Engine state will not reset between files. Also satisfies: * https://redmine.openinfosecfoundation.org/issues/2299 * https://redmine.openinfosecfoundation.org/issues/724 * https://redmine.openinfosecfoundation.org/issues/1476 Co-Authors: Dana Helwig <dana.helwig@protectwise.com> and Danny Browning <danny.browning@protectwise.com>	7 years ago
Eric Leblond	94e9d13791	doc: add ruleset commands available in unix socket	7 years ago
Pascal Delalande	0c99338e07	doc: update docs for DNS flags logging	7 years ago
Ralph Broenink	f6938933d9	doc: Amend the list of accepted protocols ... Based on the list in suricata.yaml	7 years ago
Ralph Broenink	d830177b7b	doc: Add my own name to the acknowledgements	7 years ago
Ralph Broenink	98a1ec490f	doc: Move IP reputation keyword to rules section	7 years ago
Ralph Broenink	722cff1862	doc: Restructure ToC ... * All sections up to 2 levels deep are now shown regardless of whether they are a separate page * Rename Xbits and Thresholding for more consistent naming * Minor adjustment in the Payload Keywords section	7 years ago
Ralph Broenink	196ba1da70	doc: Make the header keywords section separate sections in ToC	7 years ago
Ralph Broenink	a55a6cdb62	doc: Move flowint as integral part of flow keywords	7 years ago
Ralph Broenink	f6c766112c	doc: Minor changes in structuring of HTTP Keywords / Snort differences	7 years ago
Ralph Broenink	e9b25988ba	doc: Move pcre entirely to Payload Keywords section ... (plus remove lingering screenshot of a rule)	7 years ago
Ralph Broenink	bb1bf2643d	doc: Move fast_pattern and prefilter to dedicated page	7 years ago
Ralph Broenink	fea037fda8	doc: Moved explanation of normalized buffers to rules introduction	7 years ago
Ralph Broenink	11990c7117	doc: Move the definition of modifier keywords to the introduction	7 years ago
Ralph Broenink	dfae19247d	doc: Completely rewrite the rules introduction for more clearity	7 years ago
Ralph Broenink	274c36eb2f	doc: Meta-settings -> Meta Keywords plus some textual changes ... Most importantly, conventions are now placed in tip boxes	7 years ago
Ralph Broenink	3413793768	doc: Use lowercased keyword names as section titles	7 years ago
Ralph Broenink	a52aacb4ea	doc: Replace images of tables and rules with text in rules docs ... In some chapters of the rules documentation, many sections used examples of rules, but these were inserted into images. These have been replaced by text and HTML emphasis. Additionally, some tables embedded into images were also replaced by reST tables.	7 years ago
Ralph Broenink	44926e2369	doc: Add suricata.css to allow for some custom styling	7 years ago
Ruslan Usmanov	1090ee9d8d	rate_filter by_both through IPPair storage ... Ticket https://redmine.openinfosecfoundation.org/issues/2127	7 years ago
Gaurav Singh	637a7c8e55	Adds options to mark when a file is final. ... This takes the form of an option to add the pid of the process to file names. Additionally, it adds a suffix to the file name to indicate it is not finalized. Adding the pid to the file name reduces the likelihood that a file is overwritten when suricata is unexpectedly killed. The number in the waldo file is only written out during a clean shutdown. In the event of an improper shutdown, extracted files will be written using the old number and existing files with the same name will be overwritten. Writes extracted files and their metadata to a temporary file suffixed with '.tmp'. Renames the files when they are completely done being written. As-is there is no way to know that a file on disk is still being written to by suricata.	7 years ago
Mats Klepsland	9556d4fef3	doc: add documentation for tls_cert_fingerprint keyword	7 years ago
Victor Julien	1180687574	doc/file_data: add note on negated matching ... Explain issue #2216 and how to avoid it.	8 years ago
Victor Julien	456af8faa8	doc/napatech: formatting fixes	8 years ago
Andreas Herz	c048ee6505	doc: reflect most recent cpu affinity settings ... Some settings like output-cpu-set never been used and detect got renamed to worker. This reflects those changes already present in the yaml also within the documentation.	8 years ago
Julian	f27b4fc8fe	redis: support for rpush in list mode ... This adds a new redis mode rpush. Also more consistent config keywords orientated at the redis command: lpush and publish. Keeping list and channel config keywords for backwards compatibility	8 years ago
Phil Young	5f613e6e7d	napatech: Added section describing packet counters.	8 years ago
Phil Young	f6838f9085	napatech: Added description of hba usage.	8 years ago
Victor Julien	fc229430f8	doc: add rust and update version in install	8 years ago
Sebastian Garcia	d32ba60b51	Update public-data-sets.rst with stratosphere project ... Add the datasets of the Stratosphere project to the list.	8 years ago
Jason Ish	f715b0ae6b	doc: add pid-file section to suricata.yaml doc ... Redmine issue: https://redmine.openinfosecfoundation.org/issues/2104	8 years ago
Jason Ish	59d69666ea	doc: add more details to log rotation doc	8 years ago
Jason Ish	92f15b7ffb	doc: move log rotation to output section	8 years ago
Victor Julien	62b6f9fe25	decode: add config option to disable teredo ... Ticket #744.	8 years ago
Abbed	320b032a88	doc: small typo under '4.3.1.5' section	8 years ago
Eric Leblond	b763c7ec11	doc: document http-body logging	8 years ago
Eric Leblond	9e581436a7	doc: info about new config for alert events in EVE	8 years ago
Eric Leblond	ef88689f1e	doc: add app_proto to alert event	8 years ago
Selivanov Pavel	5162b58260	Fixed small typo: double sudo	8 years ago
Eric Leblond	f4374ffd0b	doc: some more info about alert format	8 years ago
Eric Leblond	f5ad6a2095	doc: document target keyword	8 years ago
Eric Leblond	a3f07ec02e	doc: document drop-invalid option.	8 years ago
Eric Leblond	e933eb849a	doc: document filestore update	8 years ago
Andreas Herz	bf1a8d08da	doc: rephrase nocase placement explanation	8 years ago
Victor Julien	71c6df1655	lua: add SCFlowId for getting the flow id	8 years ago
Victor Julien	4697330b73	doc: flowints formatting cleanup	8 years ago
Victor Julien	0af562d4c8	doc: move parts out of snort difference doc ... Move generic keyword descriptions to the keyword documentation.	8 years ago
David Wharton	a8d0ae460c	doc: removing (replaced) snort-compatibility.rst ... snort-compatibility.rst replaced by differences-from-snort.rst	8 years ago
David Wharton	8a53d49e81	doc: replacing snort-compatibility link ... The snort-compatibility.rst document is being replaced by differences-from-snort.rst. This commit updates the link.	8 years ago
David Wharton	6bc7c64794	doc: overhaul of the snort-compatibility document ... This is intended to replace the existing 'snort-compatibility.rst' document. Based on "The Suricata Rule Writing Guide for The Snort Expert" 2016 SuriCon talk.	8 years ago
Victor Julien	f6e3755b5c	lua: extend SCFlowAppLayerProto ... Change SCFlowAppLayerProto to return 5 values: <alproto> <alproto_ts> <alproto_tc> <alproto_orig> <alproto_expect>: alproto: detected protocol alproto_ts: detected protocol in toserver direction alproto_tc: detected protocol in toclient direction alproto_orig: pre-change/upgrade protocol alproto_expected: expected protocol in change/upgrade Orig and expect are used when changing and upgrading protocols. In a SMTP STARTTLS case, orig would normally be set to "smtp" and expect to "tls".	8 years ago
Victor Julien	79389558ac	doc: update for stream changes	8 years ago
Victor Julien	245a89b7e7	doc: http keywords update	8 years ago
Ray Ruvinskiy	7539973109	tls: logging for session resumption ... We assume session resumption has occurred if the Client Hello message included a session id, we have not seen the server certificate, but we have seen a Change Cipher Spec message from the server. Previously, these transactions were not logged at all because the server cert was never seen. Ticket: https://redmine.openinfosecfoundation.org/issues/1969	8 years ago
fooinha	36667ab8a1	doc: async mode for redis eve output ... async: true ## if redis replies are read asynchronously	8 years ago
psanders240	1223de4208	doc: Napatech docs improvement ... Fix errors and simplify filters.	8 years ago
Victor Julien	aca27ff383	doc: expand on bpf	8 years ago
Mats Klepsland	8b9f84bff2	doc: add documentation for date modifiers in eve-log	8 years ago
Mats Klepsland	37a12fe799	doc: add documentation for eve-log file rotation	8 years ago
fooinha	20d4d40051	log: tls custom format log	8 years ago
Mats Klepsland	7b1dae6251	doc: add documentation for Lua SCFlowTimestamps	8 years ago
Mats Klepsland	3b23387664	doc: add documentation for eve-log file permissions	8 years ago
Jon Zeolla	ce8a65a58e	docs: fix statement about flow:to_server	8 years ago
Jon Zeolla	1589a15495	docs: clarify how iprep works	8 years ago
Mats Klepsland	285b566205	doc: add documentation for TlsGetCertSerial Lua function	8 years ago
Mats Klepsland	ee9f822b8e	doc: add documentation for tls_cert_serial keyword	8 years ago
David Wharton	1bf7ded224	doc: specify buffers that can be used for fast_pattern ... Updated notes on the following buffers indicating that they can be used for fast_pattern: tls_cert_subject tls_cert_issuer tls_sni	8 years ago
David Wharton	b1ad770b36	doc: removed references to older Suricata versions ... docs are versioned; references to older Suricata versions undesired.	8 years ago
Mats Klepsland	e91bb09c91	doc: add documentation for TLS eve-log	8 years ago
Jason Ish	89ba5816dc	doc: update unified2 section ... Remove documentation on older unified formats that have been removed.	8 years ago
Mats Klepsland	6a382259f8	doc: documentation for custom JSON flags in eve-log	8 years ago
Victor Julien	c477c4370e	doc: update for unix socket hostbits	8 years ago
Victor Julien	71607c905a	doc: update unix socket	8 years ago
Eric Leblond	c357dafed9	doc: document the tls_sni keyword	8 years ago
Mats Klepsland	edbb035160	doc: add documentation for Lua SCFlowHasAlerts	8 years ago
Victor Julien	a2d31b5e04	doc: napatech formatting fixes	8 years ago
Victor Julien	b7b9b5b682	doc: add napatech to userguide	8 years ago
Peter Sanders	28c1516be7	doc: initial Napatech documentation	8 years ago
Victor Julien	bc38cd5932	doc: initial xbits documentation	8 years ago
Victor Julien	41074a87a0	doc: DNP3 support is now available	8 years ago
Jason Ish	0c6c9784a2	doc: document that that ;, \, " need to be escaped in rules	8 years ago
Victor Julien	3012edae1c	luajit: update default yaml and doc for 'states'	8 years ago
Jason Ish	0792f80909	doc: only build pdf on dist if pdflatex is installed	8 years ago
Jason Ish	ee16b86900	doc: fix build pdf on non gnu make platforms ... The Makefile generated by sphinx-build is GNU Make specific causing the PDF phase to fail. Instead call pdflatex directly based on how the generated Makefile was doing it.	8 years ago
Victor Julien	1aa70fb39e	doc: add rate_filter	8 years ago
Jason Ish	1a724ba851	doc: flow: update and add new keywords	8 years ago
Victor Julien	56ffba9fd8	doc: initial app-layer keywords ... Document app-layer-protocol and make a start with app-layer-event.	9 years ago
Victor Julien	c6134e007e	doc: app-layer tls including no-reassemble	9 years ago
Nicolas Thill	3750c15632	doc: add SCPacketTimestamp Lua function ... Signed-off-by: Nicolas Thill <ntl@p1sec.com>	9 years ago