Commit Graph

14 Commits (cc28284598cea084112d19529cd271b3ce5d5916)

Author SHA1 Message Date
Jason Ish 7142fdb780 quick way to make max_pending configurable. 15 years ago
Gurvinder Singh 999a200bc9 pattern matcher options support 15 years ago
Jason Ish c72d6be58b Making logging configurable. If no logging outputs are defined the default will be used. - Currently per output log formatting is not available. 15 years ago
Pierre Chifflier 4515ae13e4 Add Prelude output plugin
Add support for reporting alerts to the Prelude SIEM system, using
libprelude to send IDMEF (RFC4765) messages.

Each message contains the alert description and reference (using
the SID/GID), and a normalized description (assessment, impact,
sources etc.)

libprelude handles the connection with the manager (collecting component),
spooling and sending the event asynchronously. It also offers transport
security (using TLS and trusted certificates) and reliability (events
are retransmitted if not sent successfully).

This modules requires a Prelude profile to work (see man prelude-admin
and the Prelude Handbook for help).

Signed-off-by: Pierre Chifflier <chifflier@edenwall.com>
15 years ago
Victor Julien 6a53ab9c5a Stream engine memory handling update
The stream engine memory handling needed updating as it didn't scale. Changes:

- pools can now be initialized to size 0, meaning unlimited
- stream engine uses a memcap setting. Sessions, segments and aldata is part
  of this, app layer state isn't.
- memory is accounted using a global int that is spinlocked.
- a counter for sessions that have not been picked up because of memcap was
  added.
- all reassembly errors are converted to debug msgs.
15 years ago
Nick Rogness 2b7b78f1bf Intial IPFW support FreeBSD and OSX 15 years ago
Victor Julien f08d01a8e8 Set sensible tcp timeout defaults and no longer set the timeouts from the stream engine. 15 years ago
Pablo Rincon 5592189c04 Loading flow settings from config 15 years ago
Jason Ish 4e1acf5fd2 Require that the configuration file begins with a valid YAML version. At this time this means the configuration file must begin with
%YAML 1.1
15 years ago
Jason Ish 844c444af1 Use the configuration file to setup alert logging (and http logging).
Only setup for the live pcap modes at the moment.
15 years ago
Victor Julien bea22d91ed Set default-rule-path in example config to /etc/suricata/rules/ 15 years ago
Victor Julien d284f0d333 Set default classification file location in the config file. 15 years ago
Will Metcalf 87a435cd0d updated to include more rulesets more sane vars 15 years ago
Victor Julien ecf86f9c23 Rename to Suricata. 15 years ago