Commit Graph

9 Commits (ad1459df725f2bbcd289bb5fcec4220d40d5a670)

Author SHA1 Message Date
Victor Julien 2d4f1968b8 detect/firewall: support alert in default app policy
Support `alert` as a secondary action in app-layer firewall policies.

To implement this a Signature object is created per policy that uses
alert, and this is stored in a hash table. When the policy is applied
the signature is looked up and used in the PacketAlert.

Ticket: #8566.
2 months ago
Philippe Antoine eec4a44275 rules: SID allocation range is now documented in README.md
directly in the repo, and not in an external wiki
3 months ago
Philippe Antoine 42123cc8d9 bittorrent: add bittorrent-events.rules file
Add a file containing rules to match bittorrent protocol events.

Ticket: 8421
3 months ago
Philippe Antoine cff3d6417a snmp: add snmp-events.rules file
Add a file containing rules to match SNMP protocol events.

Ticket: 8421
3 months ago
Giuseppe Longo b6fa3c8e8c ldap: add ldap.rules file
Add a file containing rules to match LDAP protocol events.

Ticket #8368
4 months ago
Jason Ish 933127a9a8 rules: add mdns rules 1 year ago
Alex Savage 778053876b pop3: app-layer parser using sawp-pop3
This module uses the sawp-pop3 crate to parse POP3 requests and responses
Features:
- eve logging
- events for parsable but non-RFC-compliant messages

Ticket: 3243
1 year ago
Juliana Fajardini 1b6f4da23b pgsql: add events
Events for:
- parsing error when parsing pgsql packet length
- parsing error for pgsql requests (post length parsing)
- parsing error for pgsql responses (post length parsing)
- too many transactions

Include `pgsql-events.rules` file, and PGSQL events SID range definition

Task #5566
1 year ago
Jason Ish 0490279a75 rules/readme: document sid ranges in source tree 4 years ago