518 Commits (7e705269e0c8f11e04b7bcefbe421c744a8787d2)

Author	SHA1	Message	Date
David Wharton	9d2d1c4f8f	doc: minor verbiage tweaks and reST fix	4 weeks ago
Philippe Antoine	d8cb00e795	detect/tcp: make tcp.flags a generic integer with bitflags ... Ticket: 6724 Allows to use numerical values for example Also fixes some unit tests that were returning 1 after goto error FlagsTestParse05 especially took this path as de->ignored_flags != (TH_SYN|TH_RST) was false we had de->ignored_flags == 0xff ^ (TH_SYN|TH_RST) And then, we had a match, instead of what the not-run code was supposing.	4 weeks ago
Philippe Antoine	1f9236a6d8	detect/ipv4: make fragbits a generic uint16 bitflags keyword ... Ticket: 6724 Allows to use numerical values	4 weeks ago
Philippe Antoine	633180c93f	detect/integers: generalize support for bitflags modifier ... Ticket: 6724 Allows sugar syntax for bitflags keywords. While the expressivity does not increase, because we could already use numerial values with all generic integer modes, this modifier prefix is used with the strings, and follows the syntax that is already used for fragbits and tcp.flags keyword.	4 weeks ago
Philippe Antoine	4b69a31dc3	detect/integers: count argument for multi-integers ... Ticket: 7211 Allows to count the number of elements, without matching on individual elements	1 month ago
Philippe Antoine	969739d067	detect: http2.errorcode is now a generic integer ... Ticket: 7889	1 month ago
Philippe Antoine	401b2fcae6	detect: http2.frametype is now a generic integer ... Ticket: 7889	1 month ago
Victor Julien	48972d544c	doc/userguide: link to protocol details from transactional rules	2 months ago
Victor Julien	480e664b4c	doc/userguide: add xbits tx scope support ... Ticket #7680.	2 months ago
Victor Julien	a1c4167d94	doc/userguide: add initial protocols overview ... Explain per protocol mechanics for rule matching.	2 months ago
Victor Julien	e2a5bc058c	doc/userguide: fix DCERPC headings	2 months ago
Victor Julien	be5c83ed53	doc/userguide: add rule hooks to protocol doc ... Ticket #7662.	2 months ago
Victor Julien	91f258e2bc	doc/userguide: add missing app-layer protocols	2 months ago
Victor Julien	2623e67a80	doc/userguide: add missing rule protocols	2 months ago
Philippe Antoine	3641b4eda1	detect/nfs: move nfs_procedure to rust ... Make it able to use strings on the way Ticket: 6723	2 months ago
Philippe Antoine	9869fb776b	detect/snmp: pdu_type keyword now accepts strings ... Ticket: 6723	2 months ago
Philippe Antoine	0553dfa814	detect/krb5: move krb5_msg_type to rust ... Makes it a generic u32 on the way Unit tests are covered by SV tests Ticket: 6723	2 months ago
Philippe Antoine	da486af881	detect: list-keywords cli shows integers ... Ticket: 7875	2 months ago
Philippe Antoine	b298bce0e7	detect: list-keywords cli shows multi-buffers ... Ticket: 7571	2 months ago
Andreas Dolp	cc590b54c7	doc: fix typo and missing newline in rules/ssh_keywords.	2 months ago
Juliana Fajardini	21b27597d6	doc/rules/internals: minor fixes ... Fix typo and add a reference about the classtype keyword effect. Related to Task #5449	2 months ago
Fupeng Zhao	e79d735374	decode/etag: ETag 802.1BR decoder ... Ticket: #3953.	2 months ago
Philippe Antoine	cb9ab951b9	detect/integers: subslice for multi-integers	2 months ago
Philippe Antoine	82f0e725a2	detect/integers: index or_absent and or_oob ... To match if array is empty, or index is out of bounds	2 months ago
Philippe Antoine	1480cf47ab	detect/integers: nb index to match a specific number of times ... For example dns.rrtype: !A,nb>3 will match if we have more than 3 dns records which are not A	2 months ago
Philippe Antoine	6f848eeaaf	detect/integers: all1 index to match only on non-empty arrays	2 months ago
Philippe Antoine	5add185f22	http2/detect: http2.window can now use index ... Ticket: 7480	2 months ago
Philippe Antoine	83868778b9	http2/detect: http2.priority can now use index ... Ticket: 7480	2 months ago
Philippe Antoine	9fc407fd75	mqtt/detect: mqtt.type can now use index ... Ticket: 7480	2 months ago
Philippe Antoine	dad424d74a	doc: multi-integers section for rules ... Ticket: 7480 Describing the usage of index	2 months ago
Alice Akaki	8e0b0ef35f	detect: add email.body_md5 keyword ... email.body_md5 matches on md5 hash generated from email body This keyword maps to the EVE field email.body_md5 It is a sticky buffer Supports prefiltering Ticket: #7587	2 months ago
Victor Julien	46203de0e9	doc: adjust for master to main rename	2 months ago
Juliana Fajardini	27e165f760	doc/rules/index: keep rule types doc near the end ... As this chapter is more meta than about rule keywords, keep it by the end of the index, to have some semantic separation from the other sections.	2 months ago
Juliana Fajardini	d5810a42e1	userguide: document how suricata processes rules ... Added a page that explains how rules are prioritized by Suri, as well as what main different types of inspection happen and what elements are involved when ordering rules. Task #5449	2 months ago
Philippe Antoine	0026019dcf	doc: complete list of multi-buffers ... Ticket: 7867	2 months ago
Philippe Antoine	d0a513df6a	detect/integers: support kibibyte unit ... Ticket: 7869	3 months ago
Philippe Antoine	be9858d3aa	detect/integers: document usage of units ... Ticket: 7190	3 months ago
Jeff Lucovsky	21707ab26c	doc/from_base64: Emphasize keyword only values ... Emphasize that specifying the keyword only will result in the defaults for each option to be used. Issue: 7853	3 months ago
Jason Ish	7a65ca10e2	doc/lua-detection: fix example script; remove most buffers ... - Reference rule hooks instead Ticket: #7728	4 months ago
Jason Ish	4791f37ca2	doc/lua-detection: update note to mention rules are enabled by default ... In 8.0, Lua rules are enabled by default.	4 months ago
Philippe Antoine	f4378eb306	doc/devguide: document app-layer protocol detection ... Ticket: 6022	5 months ago
Jeff Lucovsky	a300df4c4d	detect/entropy: Clarify when entropy is logged ... Clarify when entropy values are logged and associated with non-alert log records.	5 months ago
Eric Leblond	751f3eef3b	doc/userguide: fix some typos	5 months ago
Eric Leblond	6236574b9c	doc/userguide: enrichment_key is now context_key	5 months ago
Eric Leblond	20a0575d96	doc/userguide: fix some typos ... Suggestions from Juliana. Co-authored-by: Juliana Fajardini Reichow <jufajardini@gmail.com>	5 months ago
Eric Leblond	40c545f8d9	doc/userguide: jsonline is now standard ndjson	5 months ago
Eric Leblond	f724c75cc9	doc/userguide: improve datajson doc	5 months ago
Eric Leblond	a652eee508	doc/userguide: remove left over datajson reference	5 months ago
Eric Leblond	7d28758a54	doc/userguide: improve datajson doc ... Patch adds ``remove_key`` option and clarifies the text.	5 months ago
Eric Leblond	0ae88a408a	doc/userguide: basic doc for jsonline format	5 months ago