10306 Commits (82eb669205ce7d845d2ed07466515196de467fab)

 

All Branches   

Search

Author	SHA1	Message	Date
Shivani Bhardwaj	d801c3e588	detect: Make keyword description consistent ... Closes redmine ticket #3137.	7 years ago
Victor Julien	d4bc460381	smtp: fix file_data inspection ... Continue tracking data if API is used with detect. Detection engine then manages the tracking. Bug #2395.	7 years ago
Victor Julien	8765839084	sip: disable output by default	7 years ago
Jason Ish	517ecd68a9	sip: rustfmt ... As this is new Rust code, format with rustfmt using default styling.	7 years ago
Jason Ish	a45a2fa1fc	sip: disable by default in 5.0	7 years ago
Jason Ish	fdbc2fe49c	sip rust fixup: remove unused import in tests	7 years ago
Jason Ish	afe065c7ac	sip fixup: _Bool -> bool	7 years ago
Giuseppe Longo	dd5d0afd79	doc: add SIP keywords	7 years ago
Giuseppe Longo	e06291922f	detect/sip.response_line: add sticky buffer ... Matches on response line field in SIP.	7 years ago
Giuseppe Longo	17de4a8023	detect/sip.request_line: add sticky buffer ... Matches on request line field in SIP.	7 years ago
Giuseppe Longo	8939ece538	detect/sip.stat_msg: add sticky buffer ... Matches on status msg field in SIP.	7 years ago
Giuseppe Longo	bd2219cac6	detect/sip.stat_code: add sticky buffer ... Matches on status code field in SIP.	7 years ago
Giuseppe Longo	8454122eb2	detect/sip.protocol: add sticky buffer ... Matches on protocol field in SIP.	7 years ago
Giuseppe Longo	2661c5b298	detect/sip.uri: add sticky buffer ... Matches on uri field in SIP.	7 years ago
Giuseppe Longo	424eead8c0	detect/sip.method: add sticky buffer ... Matches on uri field in SIP.	7 years ago
Giuseppe Longo	c88559dc72	output/json-alert: add sip metadata ... Put SIP information to alert event.	7 years ago
Giuseppe Longo	edc2a583a9	rust/sip: add SIP logger	7 years ago
Giuseppe Longo	2e975a0481	rust/sip: add parser for SIP protocol	7 years ago
Victor Julien	a2356a89f7	detect/dns.opcode: improve error reporting	7 years ago
Jason Ish	d3e2cc9926	doc: document dns.opcode keyword	7 years ago
Jason Ish	daed788d49	doc: Replace dns_query with dns.query.	7 years ago
Jason Ish	d79c23baa3	dns/detect: dns.opcode keyword ... Add a rule keyword, dns.opcode to match on the opcode flag found in the DNS request and response headers. Only exact matches are allowed with negation. Examples: - dns.opcode:4; - dns.opcode:!1;	7 years ago
Victor Julien	c68fbfcfe6	htp: simplify depth check	7 years ago
Giuseppe Longo	972be0a560	doc: update file-extraction section	7 years ago
Giuseppe Longo	de904db830	app-layer-htp: use stream depth with filestore ... This permits to use stream-depth value set for file-store. Currently if a file is being stored and hits a limit, such as request or response body, it will be truncated although file-store.stream-depth is enabled but the file should be closed and not truncated. Two unit tests have been added to verify that: - a file is stored correctly - chunk's length computation doesn’t cause an underflow	7 years ago
Giuseppe Longo	ed5a439b8e	app-layer-parser: flag a tx to use stream depth ... This adds a new API that permit to set the stream-depth file for file-storing when a rule with filestore keyword is matched.	7 years ago
Shivani Bhardwaj	b5b429c288	detect: Add missing keyword URLs and description ... Add missing keyword URLs and their description. Fix the ones that were incorrect. Partially closes redmine ticket #2974.	7 years ago
Jack Mott	adcd7ce0ff	classification: add command-and-control classtype ... Added new classtype 'command-and-control' to be used with more general TROJAN/MALWARE categories to designate traffic between infected machine and c2 server.	7 years ago
Travis Green	798d874662	doc: fix whitespace	7 years ago
Travis Green	08423282aa	doc: add to sigmatch_table	7 years ago
Travis Green	4612d4b50a	detect: syntax regex logic update ... Updated regex logic to include more spaces. Fixed spelling.	7 years ago
Jason Ish	4111272c88	config/anomaly: use enabled key word; cleanups ... The anomaly section was commented out, but the types sub object was not, which then attached the types keyword to the previous object. Instead keep "anomaly" enabled in the yaml (not commented out) and use the "enabled: no" to have it disabled by default. Additonally reformat the comments to be better viewed in 80 columns.	7 years ago
Mats Klepsland	e976d8cf74	output-lua: register app-layer parser logger for SSH ... Bug #3162	7 years ago
Mats Klepsland	1e9f767deb	output-lua: register app-layer parser logger for TLS ... Bug #3162	7 years ago
Jason Ish	61a6eaf330	htp/lzma: set limit from configuration ... Also use a default defined in Suricata, not libhtp.	7 years ago
Victor Julien	c9c23d5cda	htp: set lzma memlimit from config	7 years ago
Victor Julien	6aa2d550a1	doc/dotprefix: fix example rules	7 years ago
Jeff Lucovsky	ab3d6328ba	detect/transform: add dotprefix keyword to doc	7 years ago
Jeff Lucovsky	7808b946e3	detect/transform: add dotprefix keyword	7 years ago
Victor Julien	df325d63ea	doc/eve.anomaly: fix indent and general formatting	7 years ago
Jeff Lucovsky	9df44afa30	logging/anomaly: Add warning code for anomaly log	7 years ago
Jeff Lucovsky	075592b66f	doc: Simplified anomaly configuration settings	7 years ago
Jeff Lucovsky	aaacbf28c2	logging/anomaly: Support configuration filter types	7 years ago
Eric Leblond	35bc73e4e2	doc: change eBPF directory path	7 years ago
Victor Julien	85ba2e16ba	rust/conf: don't print failed conf lookups at info level	7 years ago
Victor Julien	c1b333c96e	rdp: disable eve.rdp by default	7 years ago
Jason Ish	664605b5f1	rdp: disable rdp by default for 5.0	7 years ago
Jason Ish	0f10298990	rdp: address comments in pull request ... Pull request: https://github.com/OISF/suricata/pull/4174 - fix commit: range -> set - OUTPUT_BUFFER_SIZE -> JSON_OUTPUT_BUFFER_SIZE - output: check for initdata first	7 years ago
Zach Kelly	caef8b5b38	protocol parser: rdp ... Initial implementation of feature 2314: 1. Add protocol parser for RDP 2. Add transactions for RDP negotiation 3. Add eve logging of transactions	7 years ago
Shivani Bhardwaj	59da7ae302	counters: Add new default for decoder events ... Set the new default for decoder events to `decoder.event` instead of the previously used `decoder`. Remove the corresponding warning for 5.0.	7 years ago