suricata

Commit Graph

Author	SHA1	Message	Date
Giuseppe Longo	8f205bb34f	llmnr: implement logger This adds an LLMNR protocol logger that reuses existing DNS functions, following the same approach as the mDNS logger: - No grouped logging - Rdata is logged in a field that is named after the rdata type - Types are logged in lower case - Flags are logged as an array Ticket #8366	1 month ago
Victor Julien	90a837cef3	detect/firewall: update discarded logic Only count alert queue overflow here, not alerts in the queue after a drop.	2 months ago
Victor Julien	8572088b0f	eve/alert: firewall default policy logging improvements Add firewall.hook to indicate the hook that the policy was set on. Ticket: #8566.	2 months ago
Victor Julien	2d4f1968b8	detect/firewall: support alert in default app policy Support `alert` as a secondary action in app-layer firewall policies. To implement this a Signature object is created per policy that uses alert, and this is stored in a hash table. When the policy is applied the signature is looked up and used in the PacketAlert. Ticket: #8566.	2 months ago
Juliana Fajardini	8a8574b149	exceptions: add dedicated flow drop reason To better control stats counters.	2 months ago
Juliana Fajardini	312967f291	detect: add flow drop by firewall as drop reason To track flow drops triggered by the firewall. Add flow drop by firewall as drop reason. As part of Ticket #7699	2 months ago
Juliana Fajardini	0acb136b40	schema: expand stats.ips.replaced explanation As this is a less obvious counter.	2 months ago
Juliana Fajardini	5b488feef5	detect/firewall: add dedicated stats counters Add a `firewall` stats counter aggregator for all firewall-related stats. De-overload "detect.alert_queue_overflow", by adding "firewall.discarded_alerts" to account for discarded drops in Firewall mode. Add Debug statements for tracking corner cases where it can be difficult to know where a drop is coming from. Added counters: - stats.firewall.blocked - stats.firewall.accepted - stats.firewall.rejected - stats.firewall.drop_reason.default_app_policy - stats.firewall.drop_reason.default_packet_policy - stats.firewall.drop_reason.flow_drop - stats.firewall.drop_reason.pre_flow_hook - stats.firewall.drop_reason.pre_stream_hook - stats.firewall.drop_reason.rules - stats.firewall.discarded_alerts Ticket #7699	2 months ago
Jeff Lucovsky	cc6fbcd5dd	etc/schema: add missing ftp fields Add ftp detect keywords to metadata Issue: 7502, 7503, 7507, 7505, 7508, 7506	2 months ago
Jason Ish	029fd1be59	eve: add rule generation source to alert record When an alert is generated from firewall context, add an engine value of "fw", otherwise "td" (for threat detect). The engine field is only added when firewall mode is enabled. Ticket: #8456	2 months ago
Philippe Antoine	54c02e1301	stats: replace dashes by underscores in app-layer protocols Ticket: 6502 Forbid dashes in json keys for better use by processing tools	2 months ago
Philippe Antoine	d030ea7f29	output: rename reject-target to reject_target Ticket: 6502 Forbid dashes in json keys for better use by processing tools	2 months ago
Jason Ish	18f742fdbd	schema: map NTP fields to keywords	3 months ago
Jason Ish	713e4eb900	ntp: convert reference_id to buffer and add keyword Store the NTP reference ID as raw network-order bytes so it can be exposed as a sticky buffer and matched with payload keywords. The reference ID is often a 4 character string, or an IP address and not just an integer identifier. Updates the log reference ID to be a string of colon separated hex digits as this matches what tshark does. Ticket: #8488	3 months ago
Jason Ish	74bb525401	ntp: create tx for all modes; log version, mode and stratum Add logging for version, mode and stratum as these will be the first keywords we will add. Ticket: #8425	3 months ago
Jason Ish	31b967b089	ntp: add transaction logging Adds basic NTP transaction logging for the current supported message types. Includes small cleanups around reference ID. Ticket: #8425	3 months ago
Victor Julien	670fdabd32	detect/snmp: add snmp.trap_type keyword Implemented as a U8 integer keyword. Ticket: #8482.	3 months ago
Victor Julien	c94cb8e098	eve/schema: add snmp trap fields	3 months ago
Eric Leblond	e4e5413478	etc/schema: add http_request_body Ticket: 8161	4 months ago
Eric Leblond	97a0ad342b	etc/schema: match on http response body Matching on the HTTP response body is not really possible as it is a transformed version that can not be accessed via the signature language.	4 months ago
Jason Ish	3e9c726aa8	etc/schema: remove "optional" field The optional field has not been valid JSON schema field since we started using it, so remove it. All fields are optional unless marked as required.	4 months ago
Victor Julien	94c16d8915	eve/igmp: add schema support for alert records	5 months ago
Victor Julien	d652b7ef62	decoder/igmp: detect RGMP (RFC 3488) RGMP is a dialect of IGMP that uses the same protocol structure, but with some different values for the fields. Detect this and log it differently.	5 months ago
Victor Julien	1b7cc2b323	decoder/igmp: initial decoder support for IGMP Basic v1, v2 and v3 header validation. Ticket: #8262.	5 months ago
Philippe Antoine	0d714b9624	doc/jsonschema: remove non-existing email fields	5 months ago
Philippe Antoine	81cc007a11	doc/jsonschema: remove non-existent ldap field Probably a duplicate typo	5 months ago
Philippe Antoine	750ae52eac	doc/jsonschema: remove obsolete insert_list_fail field Ticket: 5267	5 months ago
Ofer Dagan	2371829bf1	schema: add threshold stats counters Add schema definitions for new threshold-related statistics: - bitmap_alloc_fail: Count of bitmap allocation failures - bitmap_memuse: Memory usage by detection_filter bitmaps - memcap: Memory cap for threshold hash table - memuse: Memory usage by threshold hash table Task #7928	6 months ago
Jeff Lucovsky	54bd8edf68	decode/ipv4: Create event on unknown protos Issue: 7146 Create an event when the IPv4 header contains an unknown IP protocol.	6 months ago
Philippe Antoine	dd6baccabd	src: doc: remove more double-space typos Found with git grep -E '[a-z] [a-z]'	6 months ago
Shivani Bhardwaj	0f92583702	flow: split elephant flow detection per dir The tracking for elephant flow is done per direction however, the flag was set on the flow whenever either of the directions crossed the rate-limit defined in the settings. Given that the tracking was already split, it makes sense to split the detection tracking per direction as well and allow user to have a better control via rule language.	7 months ago
Philippe Antoine	24405a7b76	doc: http fields in json schema Ticket: 6075	7 months ago
Philippe Antoine	2f39c8c099	jsonschema: remove obsolete http fields These were moved to array request_headers/response_headers Ticket: 6075	7 months ago
Philippe Antoine	cf88ed518c	jsonschema: check for duplicate keys Ticket: 6691 And fix the one duplicate found	7 months ago
Philippe Antoine	1df568300c	doc/jsonschema: use dnp3_func instead of its alias	8 months ago
Juliana Fajardini	331bc8aeac	schema: add descriptions to global memcaps/memuses For FTP, Host, IP Pair and HTTP. Related to Task #6434	8 months ago
Juliana Fajardini	2855574a2c	schema: add additional properties to stats.capture The `stats.capture` object may have different properties based on the capture method used. This adds the ones pertaining to AF_PACKET capture. Related to Task #6434	8 months ago
Juliana Fajardini	12e0e51864	schema: add desc for each main stats module Part of the schema documentation effort. Related to Task #6434	8 months ago
Juliana Fajardini	025ffa6135	schema: allow stats.stream event counters While the counters exist, they're not present in the schema, causing validation to fail if stats.stream-events is enabled. Task #7858	8 months ago
Juliana Fajardini	173fec81f8	schema/stats: flow_mgr is actually flow.mgr The schema accounts for a stats counters group that is a subgroup of the flows stats counters. Remove `flow_mgr`, thus.	8 months ago
Philippe Antoine	85fa894425	detect: dnp3.func is now a generic integer Ticket: 7889	8 months ago
Victor Julien	acb769291a	exception-policy: add 'reject-both' option Allow rejecting both sides of a connection. Has the same support as regular reject (which is essentially rejectsrc). Ticket: #5974.	9 months ago
Philippe Antoine	047f1c5080	doc: fix enip_command name in json schema enip.command is not a keyword nor an alias	9 months ago
Philippe Antoine	969739d067	detect: http2.errorcode is now a generic integer Ticket: 7889	9 months ago
Jason Ish	5e2dc9ace3	ike: don't log empty server objects	9 months ago
Jason Ish	2d86412f46	ike: log attributes as objects IKE attributes are an array of TLV style objects, this means there can be duplicate types seen on the wire. However, Suricata logs these as a mapping with the type as the key. This can result in the JSON containing duplicate keys. To address this, log the attributes as an array of objects, allow duplicates to exist, for example: "client": { "proposals": [ { "sa_life_duration": "Unknown", "sa_life_duration_raw": 86400, } } } is now logged as: "client": { "proposals": [ {"key": "sa_life_duration", "value": "Unknown", "raw": 86400} ] } Also adds `"version": 2` to each IKE record to note the change of format from previous versions. Ticket: #7902	9 months ago
Juliana Fajardini	426955782c	schema: add descriptions to capture stats counters Task #6434	10 months ago
Juliana Fajardini	3642594e14	schema: add descriptions to decoder stats counters Continuation of Task #7793	10 months ago
Juliana Fajardini	42d563f83e	schema: fix typos s/ERPSAN/ERSPAN	10 months ago
Philippe Antoine	4f7fc25a1a	detect/dnp3: make dnp3.ind a generic uint16 bitflags keyword Ticket: 6724 Allows operations such as negation	10 months ago

1 2 3 4 5 ...

254 Commits (c8a86cdffa1dbd5ab0e3db9a381b8f806508d04e)