Commit Graph

382 Commits (a3e38861b98f11d51b44710a6cfb1b9a56cac296)

Author SHA1 Message Date
Pierre Chifflier 9dfec7e734 SNMP: add the "snmp.pdu_type" detection keyword 6 years ago
Pierre Chifflier e1dd19a0eb SNMP: add the "snmp.community" detection keyword 6 years ago
Pierre Chifflier aa608e0ca2 SNMP: add the "snmp.version" detection keyword 6 years ago
Jeff Lucovsky ab1d95446a doc: http keyword update
This changeset updates the keyword type for http.location and http.server
6 years ago
Jeff Lucovsky 0960ca0d00 detect/analyzer Add missing HTTP values
This changeset adds recognition of missing HTTP values
- Raw host
- Header names
- Server body
- User agent
6 years ago
Mats Klepsland b59e82a642 userguide: add documentation for ja3s.string keyword 6 years ago
Mats Klepsland 76b94c7073 userguide: add documentation for ja3s.hash keyword 6 years ago
Mats Klepsland d15903a2ef userguide: add documentation for Ja3SGetString Lua function 6 years ago
Mats Klepsland 37a0594417 userguide: add documentation for JA3SGetHash Lua function 6 years ago
Mats Klepsland 800608ab65 userguide: add JA3S fields to the TLS logger documentation 6 years ago
Jeff Lucovsky 8a94b93b7b doc: Anomaly logging documentation
This changeset adds discussion of anomaly log records and
the anomaly log record format.
6 years ago
Mats Klepsland 7020cffaa8 userguide: 'sticky' instead of 'Sticky' for all tls keywords 6 years ago
Mats Klepsland 03d986dd55 userguide: add documentation for tls.certs keyword 6 years ago
Jeff Lucovsky 7d6875fb68 documentation: Correct rst for ssh-keywords
This changeset corrects an error in the ssh-keywords
where 3 "`" characters were used instead of 2 "`" characters.
6 years ago
Jeff Lucovsky 97fc7c1e1a documentation: sticky buffer updates
This changeset updates the userguide for the TLS and JA3
keywords that have been renamed from <id>_<name> to <id.name>
6 years ago
Giuseppe Longo 76357350fd doc: update http.protocol description 6 years ago
Shivani Bhardwaj 4705314fd2 doc: Add manpages for suricatasc and suricatactl
Add the missing manpages and the corresponding Sphinx configuration
for the command line tools `suricatasc` and `suricatactl`.

Closes redmine ticket #884.
6 years ago
Eric Leblond 360a6ace43 doc: add info about buffer usage in lua 6 years ago
Jason Ish 355d125c4f userguide: remove dns-log 6 years ago
Jason Ish 75a018ead2 doc: remove autoconf replacement var for Rust
Set to yes as Rust is always enabled now.
6 years ago
Phil Young 6cfc39d7c9 napatech: auto-config documentation update
Added documentation describing how to configure suricata to automaticly
configure sreams and host buffers without using NTPL.  I.e. from
suricata.yaml.
6 years ago
Jeff Lucovsky 9856c5533a doc: ssh.{proto,software} documentation update 6 years ago
Jeff Lucovsky 74cd6a9ee8 doc: add http.location and http.server 6 years ago
Pascal Delalande bde65467a9 doc: add ssh protocol in eve log section 6 years ago
Victor Julien 96c6cf98d5 doc/userguide: add 3rd-party-integration to dist 6 years ago
Victor Julien f1c83c3308 doc/userguide: new 3rd party section, add bluecoat
Add Symantec SSLV (bluecoat) doc to new 3rd party section for
documenting integrating Suricata with 3rd party tools.
6 years ago
Bryant Smith 398133b6ce doc: add byte_* documentation to the userguide
Added byte_test, byte_jump and byte_extract description and example rules
6 years ago
Victor Julien d6903e70c1 file-log: remove and add warning
Feature was deprecated and scheduled for removal.

Ticket #2376
6 years ago
Eric Leblond 83a8df90f3 doc: improvement of xbits documentation page 6 years ago
Eric Leblond 43ede4db7f doc: xbits:noalert is not a valid syntax 6 years ago
Shivani Bhardwaj 2483331a5d doc/unix-socket: Add missing commands and detail
Add missing commands and their corresponding details in unix-socket
userguide.

Closes redmine ticket #2800
6 years ago
Victor Julien c47164ebc8 doc: add table for custom values of eve/http 6 years ago
Victor Julien 6fcd2db043 tile: remove files 6 years ago
Victor Julien 517b45ea2d netmap: switch to nm_* API
Process multiple packets at nm_dispatch. Use zero copy for workers
recv mode.

Add configure check netmap check for API 11+ and find netmap api version.

Add netmap guide to the userguide.
6 years ago
Maurizio Abba 6c0ec0b2f3 eve/http: add request/response http headers
Add a keyword configuration dump-all-headers, with allowed values
{both, request, response}, dumping all HTTP headers in the eve-log http
object. Each header is a single object in the list request_headers
(response_headers) with the following notation:

{
    "name": <header name>,
    "value": <header value>
}

To avoid forged malicious headers, the header name size is capped at 256
bytes, the header value size at 2048.

By default, dump-all-headers is disabled.
6 years ago
Maurizio Abba 4697351188 smtp: create raw-extraction feature
Add a raw-extraction option for smtp. When enabled, this feature will
store the raw e-mail inside a file, including headers, e-mail content,
attachments (base64 encoded). This content is stored in a normal File *,
allowing for normal file detection.
It'd also allow for all-emails extraction if a rule has
detect-filename:"rawmsg" matcher (and filestore).
Note that this feature is in contrast with decode-mime.

This feature is disabled by default, and will be disabled automatically
if decode-mime is enabled.
6 years ago
Victor Julien eb73008ccf detect/transform: add to_sha1 keyword 6 years ago
Victor Julien 75f9c1ae9f detect/transform: add to_md5 keyword 6 years ago
Victor Julien b3c021f8d0 userguide: improve stats logging documentation 6 years ago
Pascal Delalande f2dca46382 doc: fix minor typo 6 years ago
Eric Leblond 7a121d9b4c doc: add _static dir to make dist 6 years ago
Travis Green c2adb9e669 doc: added tos keyword
Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2583
6 years ago
Victor Julien 9dd925a46a userguide/install: add rust, python-yaml to ubuntu 6 years ago
jason taylor fc395eb2c5 userguide: updated hyperscan version reference
Signed-off-by: jason taylor <jtfas90@gmail.com>
6 years ago
jason taylor 131112de13 doc: Remove gulp references
Signed-off-by: jason taylor <jtfas90@gmail.com>
6 years ago
jason taylor fc54d750dd doc: add bypass keyword documentation
Signed-off-by: jason taylor <jtfas90@gmail.com>
6 years ago
Mats Klepsland be8c06adfd userguide: add documentation for ssl_version keyword 6 years ago
Victor Julien 85f2486e0b multi-tenant: document per tenant settings 6 years ago
Victor Julien 5afeebf884 doc/flow: updates and cleanups to flow section 6 years ago
Victor Julien 72dd4a5f92 doc/rules: initial transforms documentation 6 years ago