Commit Graph

12 Commits (97da91dc5ef45c9f8448bf6410343cf60897c603)

Author SHA1 Message Date
Pascal Delalande 64922a476e doc: remove deprecated force-md5 flag from userguide 6 years ago
Victor Julien 1edd9d19fc doc: add SMB to file extraction. Minor improvements. 7 years ago
Pascal Delalande 0ff60f65ec doc: update filestore for file hash extraction
Update for extraction based on md5, sha1 and sha256
7 years ago
Jason Ish 5420c0ab06 doc: document file-store v2 7 years ago
Eric Leblond 24f745553c doc: update file extraction document
Define the list of protocol parsers supporting extraction in one
single place following Andreas Herz' suggestion.
7 years ago
Eric Leblond f5ba4c231d doc: update following ftp-data changes 7 years ago
Gaurav Singh 637a7c8e55 Adds options to mark when a file is final.
This takes the form of an option to add the pid of the process to file
names. Additionally, it adds a suffix to the file name to indicate it is
not finalized.

Adding the pid to the file name reduces the likelihood that a file is
overwritten when suricata is unexpectedly killed. The number in the
waldo file is only written out during a clean shutdown. In the event
of an improper shutdown, extracted files will be written using the old
number and existing files with the same name will be overwritten.

Writes extracted files and their metadata to a temporary file suffixed
with '.tmp'. Renames the files when they are completely done being
written. As-is there is no way to know that a file on disk is still
being written to by suricata.
7 years ago
Eric Leblond e933eb849a doc: document filestore update 8 years ago
Jason Ish cd4c9e73f8 doc: fix sphinx warnings
This involved removing documents that were intentionally
not referenced as they are not good candidates for the
user guide.
9 years ago
Giuseppe Longo 3f214b506a file-store: add depth setting
When a rules match and fired filestore we may want
to increase the stream reassembly depth for this specific.

This add the 'depth' setting in file-store config,
which permits to specify how much data we want to reassemble
into a stream.
9 years ago
Victor Julien 7011d8f34c doc: remove/cleanup 'guides' 9 years ago
Jason Ish 2751baae46 doc: rename from "sphinx" to "userguide" 9 years ago