344 Commits (8c97998cb96a2c5136d4345a9d7588e3512aca26)

Author	SHA1	Message	Date
Eric Leblond	4e94c2b8c2	suricata.yaml: fix path to ebpf and xdp doc	6 years ago
Pierre Chifflier	6fc7fc74cb	SNMP: add logger	6 years ago
Pierre Chifflier	2df840a8b8	Add SNMP (v1/v2c/v3) application layer	6 years ago
Mats Klepsland	a4eaef25d6	eve: add JA3S field to TLS JSON logger ... Add JA3S object to TLS JSON logger (extended log).	6 years ago
Eric Leblond	5d76f0897c	af-packet: remove rollover reference ... This patch removes reference to rollover in the configuration file and add warnings when it is used.	6 years ago
Jeff Lucovsky	cc492c50c8	eve/logging: disable anomaly logging by default ... Disable anomaly logging by default. Networks with excessive issues may experience packet processing degradation.	6 years ago
Jeff Lucovsky	a8938f449d	logging: Anomaly logging ... This changeset adds anomaly logging to suricata for issue 2282. Anomaly logging is controlled via the `anomaly` section within eve-log. There is a single option -- `packethdr` -- for including the packet header in the anomaly.	6 years ago
Jason Ish	fc3191dc2d	config: enable all things requiring Rust ... Instead of only enabling them if Rust is enabled, as Rust is always enabled now.	6 years ago
Phil Young	05271bfbe5	napatech: simplify integration with Napatech cards ... - There is now an option to automatically create streams on the correct NUMA node when using cpu affinity. - When not using cpu affinity the user can specify streams to be created in the suricata.yaml file. It is no longer required to use NTPL to create streams before running suricata. - The legacy usage model of running NTPL to create streams is still available. This can be used for legacy configurations and complex configurations that cannot be satisfied by the auto-config option.	6 years ago
Victor Julien	d00950be81	log/file: use default-log-dir for suricata.log ... Default to just suricata.log instead of the full path, so that in user mode we can log in the user mode location.	6 years ago
Eric Leblond	abe2836caf	suricata.yaml: fix name of encryption-handling var	6 years ago
Victor Julien	d6903e70c1	file-log: remove and add warning ... Feature was deprecated and scheduled for removal. Ticket #2376	6 years ago
Victor Julien	6fcd2db043	tile: remove files	6 years ago
Victor Julien	517b45ea2d	netmap: switch to nm_* API ... Process multiple packets at nm_dispatch. Use zero copy for workers recv mode. Add configure check netmap check for API 11+ and find netmap api version. Add netmap guide to the userguide.	6 years ago
Maurizio Abba	6c0ec0b2f3	eve/http: add request/response http headers ... Add a keyword configuration dump-all-headers, with allowed values {both, request, response}, dumping all HTTP headers in the eve-log http object. Each header is a single object in the list request_headers (response_headers) with the following notation: { "name": <header name>, "value": <header value> } To avoid forged malicious headers, the header name size is capped at 256 bytes, the header value size at 2048. By default, dump-all-headers is disabled.	6 years ago
Maurizio Abba	4697351188	smtp: create raw-extraction feature ... Add a raw-extraction option for smtp. When enabled, this feature will store the raw e-mail inside a file, including headers, e-mail content, attachments (base64 encoded). This content is stored in a normal File *, allowing for normal file detection. It'd also allow for all-emails extraction if a rule has detect-filename:"rawmsg" matcher (and filestore). Note that this feature is in contrast with decode-mime. This feature is disabled by default, and will be disabled automatically if decode-mime is enabled.	6 years ago
Victor Julien	0d86263efd	eve.stats: make decoder event prefix configurable	6 years ago
Victor Julien	1dd81f7346	yaml: add missing eve pcap-file comment	6 years ago
Jason Ish	87250da0fc	rust/dns: add v1 dns logging ... Redmine issue: https://redmine.openinfosecfoundation.org/issues/2704	6 years ago
Travis Green	3539ae3041	Updated link for Prelude SIEM ... Updated link for Prelude SIEM to https://www.prelude-siem.org/	6 years ago
Eric Leblond	24806c2102	suricata.yaml: fix path to XDP doc	6 years ago
Victor Julien	1467c30883	pfring: implement 'threads: auto' ... If threads is set to auto, first try the CPU count. If that would fail, fall back to RSS queue count.	6 years ago
Victor Julien	3ba2c9fba7	pfring: multiple receive threads is not experimental	6 years ago
Victor Julien	4f84672d7c	stats: decoder/stream events as stats	6 years ago
Victor Julien	c4d8508f51	eve/json: introduce community flow id ... Add support for community flow id, meant to give a records a predictable flow id that can be used to match records to output of other tools. Takes a 'seed' that needs to be same across sensors and tools to make the id less predictable.	6 years ago
Victor Julien	ed712768d5	rust: enable by default ... Remove 'experimental' label for Rust, and enable it by default if rustc and cargo (and libjansson) are available. Add rustc and cargo versions to the build-info.	7 years ago
Victor Julien	8b213e9d63	yaml: fix typo	7 years ago
jason taylor	d038c78cd6	config: added ja3 to tls custom logging example ... Signed-off-by: jason taylor <jtfas90@gmail.com>	7 years ago
Konstantin Klinger	2938f797f2	yaml: add var for DC_SERVERS (Domain Controller)	7 years ago
Konstantin Klinger	99193b1492	yaml: add note for dns v1 not available with rust	7 years ago
Konstantin Klinger	a3832e4594	yaml: add note for dns.log with Rust ... It is not availbale when rust is enabled.	7 years ago
Victor Julien	0b46d027d0	rust/smb: implement stream-depth, unlimited by default	7 years ago
Jason Ish	64b6ff7392	config: better default rule file configuration ... Move the rule file configuration down near the bottom of the configuration file under advanced settings. With the bundling of Suricata-Update, any rule file configuration within suricata.yaml could be considered advanced. Add extra comments to the yaml to make it more clear which was enabled at installation time.	7 years ago
jason taylor	a2bc008093	add note about eve-alert metadata ... Signed-off-by: jason taylor <jtfas90@gmail.com>	7 years ago
Victor Julien	693a3df031	tls: document encrypt-handling option ... Document in sample yaml and user guide.	7 years ago
Jason Ish	9210d8743b	rust/dhcp: Rust based DHCP decoder and logger. ... This is a DHCP decoder and logger written in Rust. Unlike most parsers, this one is stateless so responses are not matched up to requests by Suricata. However, the output does contain enough fields to match them up in post-processing. Rules are included to alert of malformed or truncated options.	7 years ago
Pierre Chifflier	6ae53a1869	Add event rules for Kerberos 5	7 years ago
Pierre Chifflier	fd175f2bfb	Add logger for Kerberos 5 metadata	7 years ago
Pierre Chifflier	77f0c11c9e	Add Kerberos 5 application layer	7 years ago
Jason Ish	0d51ebc71a	eve/alert: use eve-level xff config by default ... The alert section can still have an xff configuration which will take priority over the eve level xff config.	7 years ago
Jason Ish	36ec1281b2	eve/files: use eve-level xff config by default ... The files section can still have an xff configuration which will take priority over the eve level xff config.	7 years ago
Jason Ish	6607ee8489	eve/http: use eve-level xff config by default ... The http section can still have an xff configuration which will take priority over the eve level xff config.	7 years ago
Jason Ish	576584152c	eve: use eve-level xff configuration ... If an "xff" configuration section exists on the eve object, parse and save it for child loggers to use.	7 years ago
Maurizio Abba	2543930d74	xff: Use XFF configuration in eve and filestore ... XFF configuration is already set in app-layer-htp-xff, and in output-json-alert. Extending XFF configuration to files and HTTP allow to get the same behavior as for alerts. Extend the configuration of filestore json to let filestore metafile dump be aware of xff. This is available only if write-fileinfo is set to yes and file-store version is 2.	7 years ago
Max Fillinger	b85a0b188b	Add an option for compressing pcap-log files ... Introduces the option 'outputs.pcap-log.compression' which can be set to 'none' or 'lz4', plus options to set the compression level and to enable checksums. SCFmemopen is used to make pcap_dump() write to a buffer which is then compressed using liblz4.	7 years ago
Jason Ish	e048a74ecd	rules: set default rule dir to suricata-update if bundled ... If suricata-update is bundled, set the default-rule-dir to lib/suricata/rules under the $localstatedir For now use 2 rule-files section that are renamed depending on if suricata-update is bundled or not.	7 years ago
Victor Julien	f201a3761f	rust: remove multi level 'experimental' ... Don't treat 'external' parsers as more experimental. All parsers depend on crates to some extend, and all have C glue code. So the distinction doesn't really make sense.	7 years ago
Pierre Chifflier	d16397ce61	Add rules for IKEv2 events	7 years ago
Pierre Chifflier	c99b9462d7	Add new parser: IKEv2 ... Add a new parser for Internet Key Exchange version (IKEv2), defined in RFC 7296. The IKEv2 parser itself is external. The embedded code includes the parser state and associated variables, the state machine, and the detection code. The parser looks the first two messages of a connection, and analyzes the client and server proposals to check the cryptographic parameters.	7 years ago
Eric Leblond	66b37d8689	suricata.yaml: fix some spelling mistakes	7 years ago