Giuseppe Longo
76357350fd
doc: update http.protocol description
6 years ago
Eric Leblond
360a6ace43
doc: add info about buffer usage in lua
6 years ago
Jeff Lucovsky
9856c5533a
doc: ssh.{proto,software} documentation update
6 years ago
Jeff Lucovsky
74cd6a9ee8
doc: add http.location and http.server
6 years ago
Bryant Smith
398133b6ce
doc: add byte_* documentation to the userguide
...
Added byte_test, byte_jump and byte_extract description and example rules
6 years ago
Eric Leblond
83a8df90f3
doc: improvement of xbits documentation page
6 years ago
Eric Leblond
43ede4db7f
doc: xbits:noalert is not a valid syntax
6 years ago
Victor Julien
eb73008ccf
detect/transform: add to_sha1 keyword
6 years ago
Victor Julien
75f9c1ae9f
detect/transform: add to_md5 keyword
6 years ago
Pascal Delalande
f2dca46382
doc: fix minor typo
6 years ago
Travis Green
c2adb9e669
doc: added tos keyword
...
Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2583
6 years ago
jason taylor
fc54d750dd
doc: add bypass keyword documentation
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
6 years ago
Mats Klepsland
be8c06adfd
userguide: add documentation for ssl_version keyword
6 years ago
Victor Julien
5afeebf884
doc/flow: updates and cleanups to flow section
6 years ago
Victor Julien
72dd4a5f92
doc/rules: initial transforms documentation
6 years ago
Mats Klepsland
e92fda37c9
doc: add documentation for SSH keywords
6 years ago
Mats Klepsland
10fcc8d2ca
doc: update tls.version documentation
6 years ago
Victor Julien
c677e07d3e
kerberos: minor doc updates, add author
6 years ago
Jason Ish
fb85822730
dhcp: update user guide
6 years ago
Pierre Chifflier
c51ff32adb
Document Kerberos 5 parsing events
6 years ago
Pierre Chifflier
1076c7cd47
Add krb5_err_code detection keyword
6 years ago
Pierre Chifflier
d6b9c0294a
Add krb5_cname and krb5_sname detection keywords
6 years ago
Pierre Chifflier
0bd81ff838
Add krb5_msg_type detection keyword
6 years ago
Pierre Chifflier
1e5f5d405f
Kerberos 5: add support for TCP as well
6 years ago
Pascal Delalande
4f48927c44
doc: spelling mistakes in various sections of the user guide
7 years ago
Eric Leblond
0c4bf2d332
doc: add a lua support top level section
...
Both output and signature are using lua. So lua functions should
be displayed in a single section.
7 years ago
Pascal Delalande
e3c5784dd5
doc: minor updates (tls custom, TODO removal, ftp/smb file rules)
7 years ago
Victor Julien
ccde621ceb
doc: add suricata-update to intro for rules
7 years ago
Pierre Chifflier
6eb48e1e93
Add ikev2 to userguide
7 years ago
Victor Julien
26e807ca34
doc: fix http_header_names example
7 years ago
Mats Klepsland
a357f52fa5
doc: add documentation for ja3_string keyword
7 years ago
Mats Klepsland
38cc6f595f
doc: add documentation for ja3_hash keyword
7 years ago
David DIALLO
c2236ea2b3
modbus: Support Unit Identifier
...
When destination IP address does not suffice to uniquely identify
the Modbus/TCP device.
Some Modbus/TCP devices act as gateways to other Modbus/TCP devices
that are behind this gateways.
7 years ago
Andreas Herz
2e8678a5ff
docs: replace redmine links and enforce https on oisf urls
7 years ago
David DIALLO
6c643d8975
modbus: duplicate alerts unaware of direction
...
Remove DetectAppLayerInspectEngineRegister for TOCLIENT direction
because Modbus inspection engine is only performing in request (TOSERVER).
Detect Value keyword in read access rule. In read access, match on value
is not possible.
Update Modbus keyword documentation.
7 years ago
Giuseppe Longo
d2121945c9
doc: update file_data description
7 years ago
Eric Leblond
72c8cd67d5
doc: documentation update on metadata
7 years ago
Pascal Delalande
0ff60f65ec
doc: update filestore for file hash extraction
...
Update for extraction based on md5, sha1 and sha256
7 years ago
Victor Julien
07738af868
detect/content: introduce startswith modifier
...
Add startswith modifier to simplify matching patterns at the start
of a buffer.
Instead of:
content:"abc"; depth:3;
This enables:
content:"abc"; startswith;
Especially with longer patterns this makes the intention of the rule
more clear and eases writing the rules.
Internally it's simply a shorthand for 'depth:<pattern len>;'.
Ticket https://redmine.openinfosecfoundation.org/issues/742
7 years ago
Eric Leblond
f5ba4c231d
doc: update following ftp-data changes
7 years ago
Andreas Herz
6f0794c16f
keyword-filesize: add units
7 years ago
Ralph Broenink
f6938933d9
doc: Amend the list of accepted protocols
...
Based on the list in suricata.yaml
7 years ago
Ralph Broenink
98a1ec490f
doc: Move IP reputation keyword to rules section
7 years ago
Ralph Broenink
722cff1862
doc: Restructure ToC
...
* All sections up to 2 levels deep are now shown regardless of whether they are a separate page
* Rename Xbits and Thresholding for more consistent naming
* Minor adjustment in the Payload Keywords section
7 years ago
Ralph Broenink
196ba1da70
doc: Make the header keywords section separate sections in ToC
7 years ago
Ralph Broenink
a55a6cdb62
doc: Move flowint as integral part of flow keywords
7 years ago
Ralph Broenink
f6c766112c
doc: Minor changes in structuring of HTTP Keywords / Snort differences
7 years ago
Ralph Broenink
e9b25988ba
doc: Move pcre entirely to Payload Keywords section
...
(plus remove lingering screenshot of a rule)
7 years ago
Ralph Broenink
bb1bf2643d
doc: Move fast_pattern and prefilter to dedicated page
7 years ago
Ralph Broenink
fea037fda8
doc: Moved explanation of normalized buffers to rules introduction
7 years ago
Ralph Broenink
11990c7117
doc: Move the definition of modifier keywords to the introduction
7 years ago
Ralph Broenink
dfae19247d
doc: Completely rewrite the rules introduction for more clearity
7 years ago
Ralph Broenink
274c36eb2f
doc: Meta-settings -> Meta Keywords plus some textual changes
...
Most importantly, conventions are now placed in tip boxes
7 years ago
Ralph Broenink
3413793768
doc: Use lowercased keyword names as section titles
7 years ago
Ralph Broenink
a52aacb4ea
doc: Replace images of tables and rules with text in rules docs
...
In some chapters of the rules documentation, many sections used examples of rules, but these were inserted into images. These have been replaced by text and HTML emphasis.
Additionally, some tables embedded into images were also replaced by reST tables.
7 years ago
Mats Klepsland
9556d4fef3
doc: add documentation for tls_cert_fingerprint keyword
7 years ago
Victor Julien
1180687574
doc/file_data: add note on negated matching
...
Explain issue #2216 and how to avoid it.
7 years ago
Abbed
320b032a88
doc: small typo under '4.3.1.5' section
7 years ago
Eric Leblond
f5ad6a2095
doc: document target keyword
7 years ago
Andreas Herz
bf1a8d08da
doc: rephrase nocase placement explanation
7 years ago
Victor Julien
4697330b73
doc: flowints formatting cleanup
8 years ago
Victor Julien
0af562d4c8
doc: move parts out of snort difference doc
...
Move generic keyword descriptions to the keyword documentation.
8 years ago
David Wharton
a8d0ae460c
doc: removing (replaced) snort-compatibility.rst
...
snort-compatibility.rst replaced by differences-from-snort.rst
8 years ago
David Wharton
8a53d49e81
doc: replacing snort-compatibility link
...
The snort-compatibility.rst document is being replaced by
differences-from-snort.rst. This commit updates the link.
8 years ago
David Wharton
6bc7c64794
doc: overhaul of the snort-compatibility document
...
This is intended to replace the existing 'snort-compatibility.rst'
document.
Based on "The Suricata Rule Writing Guide for The Snort Expert"
2016 SuriCon talk.
8 years ago
Victor Julien
245a89b7e7
doc: http keywords update
8 years ago
Mats Klepsland
ee9f822b8e
doc: add documentation for tls_cert_serial keyword
8 years ago
David Wharton
1bf7ded224
doc: specify buffers that can be used for fast_pattern
...
Updated notes on the following buffers indicating that they can
be used for fast_pattern:
tls_cert_subject
tls_cert_issuer
tls_sni
8 years ago
David Wharton
b1ad770b36
doc: removed references to older Suricata versions
...
docs are versioned; references to older Suricata versions undesired.
8 years ago
Victor Julien
c477c4370e
doc: update for unix socket hostbits
8 years ago
Eric Leblond
c357dafed9
doc: document the tls_sni keyword
8 years ago
Victor Julien
bc38cd5932
doc: initial xbits documentation
8 years ago
Victor Julien
41074a87a0
doc: DNP3 support is now available
8 years ago
Jason Ish
0c6c9784a2
doc: document that that ;, \, " need to be escaped in rules
8 years ago
Jason Ish
1a724ba851
doc: flow: update and add new keywords
8 years ago
Victor Julien
56ffba9fd8
doc: initial app-layer keywords
...
Document app-layer-protocol and make a start with app-layer-event.
8 years ago
Victor Julien
e3b2d95100
doc: add recent tls keywords
8 years ago
Victor Julien
08b875c03b
doc: clean up fast_pattern
8 years ago
Victor Julien
f1046db113
doc: fix header keywords layout
8 years ago
Victor Julien
d80914d350
doc: move rule reload and adding rules into rule-management
8 years ago
Victor Julien
e24c3937b3
doc: add rule-management chapter
8 years ago
Victor Julien
e5ee665f24
doc: rewrite rule reload doc
8 years ago
Victor Julien
a35bea28f3
doc: rules-meta typo
8 years ago
Victor Julien
76b55214f0
doc: rules-meta small cleanup
8 years ago
Victor Julien
3cf1b12061
doc: http sticky vs modifier
8 years ago
Victor Julien
0d15593258
doc: move urilen to other uri keywords
8 years ago
Victor Julien
34bfacdee0
doc: add minimal http request/response line sections
8 years ago
Jason Ish
cd4c9e73f8
doc: fix sphinx warnings
...
This involved removing documents that were intentionally
not referenced as they are not good candidates for the
user guide.
8 years ago
Victor Julien
92b393ee9a
doc: include enip page
8 years ago
Victor Julien
a2d8cfb5d3
doc: reorder rule docs
8 years ago
kwong
a3ffebd835
Adding SCADA EtherNet/IP and CIP protocol support
...
Add support for the ENIP/CIP Industrial protocol
This is an app layer implementation which uses the "enip" protocol
and "cip_service" and "enip_command" keywords
Implements AFL entry points
8 years ago
Victor Julien
5bd906ae9f
doc: prefilter keyword and config
8 years ago
Victor Julien
73b355e24a
doc: fix lua keyword name
8 years ago
Victor Julien
7ad667f282
doc: move snort compat to rule chapter
8 years ago
Jason Ish
7f5ffeebad
doc: dns: sync up with wiki
8 years ago
Andreas Herz
7806ae8f57
docs: sync up to recent redmine
8 years ago
Jason Ish
a96225527a
doc: update url to modbus paper as advised by David Diallo.
8 years ago
Jason Ish
2751baae46
doc: rename from "sphinx" to "userguide"
8 years ago