495 Commits (82f0e725a22a080a526c069255254c5033843b31)

Author	SHA1	Message	Date
Philippe Antoine	82f0e725a2	detect/integers: index or_absent and or_oob ... To match if array is empty, or index is out of bounds	2 months ago
Philippe Antoine	1480cf47ab	detect/integers: nb index to match a specific number of times ... For example dns.rrtype: !A,nb>3 will match if we have more than 3 dns records which are not A	2 months ago
Philippe Antoine	6f848eeaaf	detect/integers: all1 index to match only on non-empty arrays	2 months ago
Philippe Antoine	5add185f22	http2/detect: http2.window can now use index ... Ticket: 7480	2 months ago
Philippe Antoine	83868778b9	http2/detect: http2.priority can now use index ... Ticket: 7480	2 months ago
Philippe Antoine	9fc407fd75	mqtt/detect: mqtt.type can now use index ... Ticket: 7480	2 months ago
Philippe Antoine	dad424d74a	doc: multi-integers section for rules ... Ticket: 7480 Describing the usage of index	2 months ago
Alice Akaki	8e0b0ef35f	detect: add email.body_md5 keyword ... email.body_md5 matches on md5 hash generated from email body This keyword maps to the EVE field email.body_md5 It is a sticky buffer Supports prefiltering Ticket: #7587	2 months ago
Victor Julien	46203de0e9	doc: adjust for master to main rename	2 months ago
Juliana Fajardini	27e165f760	doc/rules/index: keep rule types doc near the end ... As this chapter is more meta than about rule keywords, keep it by the end of the index, to have some semantic separation from the other sections.	2 months ago
Juliana Fajardini	d5810a42e1	userguide: document how suricata processes rules ... Added a page that explains how rules are prioritized by Suri, as well as what main different types of inspection happen and what elements are involved when ordering rules. Task #5449	2 months ago
Philippe Antoine	0026019dcf	doc: complete list of multi-buffers ... Ticket: 7867	2 months ago
Philippe Antoine	d0a513df6a	detect/integers: support kibibyte unit ... Ticket: 7869	3 months ago
Philippe Antoine	be9858d3aa	detect/integers: document usage of units ... Ticket: 7190	3 months ago
Jeff Lucovsky	21707ab26c	doc/from_base64: Emphasize keyword only values ... Emphasize that specifying the keyword only will result in the defaults for each option to be used. Issue: 7853	3 months ago
Jason Ish	7a65ca10e2	doc/lua-detection: fix example script; remove most buffers ... - Reference rule hooks instead Ticket: #7728	4 months ago
Jason Ish	4791f37ca2	doc/lua-detection: update note to mention rules are enabled by default ... In 8.0, Lua rules are enabled by default.	4 months ago
Philippe Antoine	f4378eb306	doc/devguide: document app-layer protocol detection ... Ticket: 6022	5 months ago
Jeff Lucovsky	a300df4c4d	detect/entropy: Clarify when entropy is logged ... Clarify when entropy values are logged and associated with non-alert log records.	5 months ago
Eric Leblond	751f3eef3b	doc/userguide: fix some typos	5 months ago
Eric Leblond	6236574b9c	doc/userguide: enrichment_key is now context_key	5 months ago
Eric Leblond	20a0575d96	doc/userguide: fix some typos ... Suggestions from Juliana. Co-authored-by: Juliana Fajardini Reichow <jufajardini@gmail.com>	5 months ago
Eric Leblond	40c545f8d9	doc/userguide: jsonline is now standard ndjson	5 months ago
Eric Leblond	f724c75cc9	doc/userguide: improve datajson doc	5 months ago
Eric Leblond	a652eee508	doc/userguide: remove left over datajson reference	5 months ago
Eric Leblond	7d28758a54	doc/userguide: improve datajson doc ... Patch adds ``remove_key`` option and clarifies the text.	5 months ago
Eric Leblond	0ae88a408a	doc/userguide: basic doc for jsonline format	5 months ago
Eric Leblond	9873c5d2e1	doc/userguide: add dataset with json	5 months ago
Victor Julien	f2faba5a23	detect/config: add flow tracking doc	5 months ago
Victor Julien	ecbcccf355	detect: add tcp.wscale keyword ... Allows matching on wscale option value in TCP header options. Ticket: #7713.	5 months ago
Jeff Lucovsky	a8a3780276	doc/entropy: Document the entropy log output	5 months ago
Juliana Fajardini	c5b9277474	doc/payload: fix typo, minor formatting changes	6 months ago
Juliana Fajardini	627b8900ef	doc/rule-types: fix typo	6 months ago
Jason Ish	4a655053e8	mdns: add mdns parser, logger and detection ... The mDNS support is based heavily on the DNS support, reusing the existing DNS parser where possible. This meant adding variations on DNS, as mDNS is a little different. Mainly being that *all* mDNS traffic is to_server, yet there is still the concept of request and responses. Keywords added are: - mdns.queries.rrname - mdns.answers.rrname - mdns.additionals.rrname - mdns.authorities.rrname - mdns.response.rrname They are mostly in-line with the DNS keywords, except mdns.answers.rdata which is a better than that mdns.response.rrname, as its actually looking at the rdata, and not rrnames. mDNS has its own logger that differs from the DNS logger: - No grouped logging - In answers/additionals/authorities, the rdata is logged in a field that is named after the rdata type. For example, "txt" data is no longer logged in the "rdata" field, but instead a "txt" field. We currently already did this in DNS for fields that were not a single buffer, like SOA, SRV, etc. So this makes things more consistent. And gives query like semantics that the "grouped" object was trying to provide. - Types are logged in lower case ("txt" instead of "TXT") - Flags are logged as an array: "flags": ["aa", "z"] Ticket: #3952	6 months ago
Juliana Fajardini	404bb53ce9	pgsql: add query keyword ... Add the `pgsql.query` rule keyword to match on PGSQL's query request message contents. This currently matches on the EVE field: pgsql.request.simple_query `pgsql.query` is a sticky buffer and can be used as a fast_pattern. Task #6259	6 months ago
jason taylor	ca9b29c2d0	doc: update http.header_names normalization info	6 months ago
Jeff Lucovsky	77139e0cb1	doc/ftp: Document ftp.completion_code sticky buffer ... This commit adds documentation for the ftp.completion_code sticky buffer. This is a multi-buffer match. Issue: 7507	6 months ago
Jeff Lucovsky	53c8a0f8f1	doc: Document luaxform transform ... Issue: 2290	6 months ago
Jeff Lucovsky	aec2513799	doc/ftp: Document ftp.reply_received ... Add documentation for the ftp.reply_received keyword.	6 months ago
Jeff Lucovsky	0b02b1d2d1	doc/ftp: Document ftp.mode keyword ... Document the ftp.mode keyword Fixup a typo in the ftp.reply keyword section. Issue: 7505	6 months ago
Philippe Antoine	daabab7381	doc/ssh: document hooks ... Ticket: 7607	7 months ago
Jeff Lucovsky	ff59f215d6	doc/ftp: Document ftp.dynamic_port keyword ... Document the sticky buffer for ftp.dynamic_port	7 months ago
Jason Ish	be483dc873	doc/userguide: document that lua dns rules need hooks ... And remove the old "keywords" that a lua Rule can register with for DNS.	7 months ago
Philippe Antoine	8757ad5fd3	detect/dns: support string for dns.rrtype ... Ticket: 6723	7 months ago
Philippe Antoine	44a6f7f8ca	detect/dns: support string for dns.rcode ... Ticket: 6723	7 months ago
Alice Akaki	bda0890834	detect: add email.received keyword ... email.received matches on MIME EMAIL Received This keyword maps to the EVE field email.received[] It is a sticky buffer Supports multiple buffer matching Supports prefiltering Ticket: #7599	7 months ago
James	deb761367d	doc: Update bypass docs to use new keyword format ... Ticket: #7143 Update documentation to reflect new sticky buffer keyword format	7 months ago
Victor Julien	e3c6554ee6	detect/app-layer-protocol: allow matching on 'unknown'	7 months ago
Alice Akaki	ca429ef5e3	detect: add email.url keyword ... email.url matches on URLs extracted from an email This keyword maps to the EVE field email.url[] Supports multiple buffer matching Supports prefiltering Ticket: #7597	7 months ago
Victor Julien	57c73880db	lua: enable lua rules by default ... Now that sandboxing is in place, lua rule support is enabled by default.	7 months ago