1034 Commits (d43154adbe0e3b2cd66b9334d6cbe58523b23f26)

Author	SHA1	Message	Date
Juliana Fajardini	ef63aa50e2	doc/configuration: improve emergency-recovery docs ... When removing mentions to `prune-flows` a few inconsistencies for how we write and refer to `emergency-recovery` were left behind, still.	3 weeks ago
Philippe Antoine	de9413c654	detect: safety for app-layer logging of stream-only rules ... If a stream-only rule matches, and we find a tx where we want to log the app-layer data, store into the tx data that we already logged, so that we do not log again the app-layer metadata Ticket: 7085	3 weeks ago
jason taylor	f46a8776ec	doc: add note about big endian for icmp_seq match	3 weeks ago
Juliana Fajardini	1420c83a87	doc/configuration: remove mention to prune-flows ... Although the `prune-flows` option was removed with a5587fec2e, when documentation for the suricata.yaml config file was added with b252b0d, this option was also included - as has remained until now.	4 weeks ago
Jeff Lucovsky	8064847fc6	doc: Document reference config setting ... Issue: 4974	4 weeks ago
Philippe Antoine	0ebb84538e	http2: add frames support ... Ticket: 5743 Why ? To add detection capabilities	1 month ago
Jason Ish	685baa9680	output-filedata: rename and document registration function ... Prefix registration function and pointer function type with SC, as well as document. Ticket: #7227	1 month ago
Jason Ish	b51eeb3ab5	output-file: rename and document registration function ... Rename OutputRegisterFileLogger to SCOutputRegisterFileLogger, add function documentation and include in userguide. Ticket: #7227	1 month ago
Jason Ish	14b648f286	output-streaming: rename and document registration ... Prefix the registration function and types with "SC", and add function documentation. Ticket: #7227	1 month ago
Jason Ish	1ebf33b3c9	output-tx: rename and document transaction logger registration ... Rename OutputRegisterTxLogger to SCOutputRegisterTxLogger to make it part of the public API as well as document. Ticket: #7227	1 month ago
Jason Ish	bb128e3959	devguide: more on low level logging ... Use the extending/output section to introduce the low level logging API. Ticket: #7227	1 month ago
Juliana Fajardini	f3e1095244	userguide: update Security Onion docs reference ... They have updated their docs domain, leading to the link we had returning a 404. Also checked the other links. Although some seem to only contain old traffic, they all still work.	1 month ago
Sascha Steinbiss	cb14e44780	userguide: fix spelling of `security_result` EVE field ... This ensures that the correct spelling of the `security_result` EVE field for RFB (as opposed to `security-result`) is also reflected in the documentation. Ticket: #7210	1 month ago
Shivani Bhardwaj	1345c6d1cb	doc/file-extraction: fix highlight syntax	1 month ago
Juliana Fajardini	682b199ea0	userguide: expand documentation for rule profiling ... The page about performance and rule profiling showed the table generated by rules profiling but didn't inform how to achieve nor find it. Task #4359	1 month ago
Jason Ish	15fe844ae7	syslog: deprecate ... The standalone syslog output is now deprecated for Suricata 8. Display a warning on use and add notes to the userguide. Ticket: #6544	2 months ago
Jason Ish	5853fb922d	tls-log: deprecate ... tls-log is now deprecated and will be removed in Suricata 9.0. Display a deprecation notice on use, and add notes to the user guide. Ticket: #6542	2 months ago
Jason Ish	ab26323a96	http-log: deprecate ... http-log is now deprecated and will be removed in Suricata 9.0. Display a deprecation notice on use, and add notes to the userguide. Issue: #6543	2 months ago
Victor Julien	688bd538cf	pcap: implement pcap-file-buffer-size option ... Allows easy specification of buffer size on the commandline. Ticket: #7155.	2 months ago
Juliana Fajardini	246acc7140	userguide: clarify flow:stateless explanation ... While not incorrect, the previous wording made the sentence almost paradoxical. While at it, also highlight a side effect that might not be so clear to users. Related to Bug #6976	2 months ago
Philippe Antoine	62a186ceef	detect/rfb: move keywords to rust ... Ticket: 7178 On the way, convert rfb.secresult to a generic integer with enumeration cf ticket 6723	2 months ago
Victor Julien	fa9cae3899	doc/userguide: document logging changes from 6 to 7 ... Minor other logging related improvements like clarifying language and improving formatting for pdf output.	2 months ago
Philippe Antoine	0b2ed97f36	ssh: frames support ... Ticket: 5734 Adds frames for SSH records, that come after banner, and before the data is encrypted. These records may contain cipher lists for instance.	2 months ago
Giuseppe Longo	70ed9f91d8	doc: add ldap protocol	3 months ago
Philippe Antoine	bce8f4b853	detect/ssh: remove deprecated keywords ... Ticket: 2377	3 months ago
Philippe Antoine	0a1062fad2	detect/mqtt: move keywords to rust ... Ticket: 4863 On the way, convert some keywords to use the first-class integer support. And helpers for pure rust the support for multi-buffer. Move the C unit tests about keyword mqtt.protocol_version to unit tests for generic integer parsing, and test version 5 instead of testing twice version 3. Also iterate all tx's messages for reason code as is done for other keywords. And allow detection on empty topics.	3 months ago
Jason Ish	5f516c5896	doc: add pf-ring plugin upgrade notes ... Ticket: #7162	3 months ago
Philippe Antoine	e0fd59a20d	doc: state that payload-length includes the gaps	3 months ago
Jason Ish	4d3d57249a	doc: update dns section of the eve format documentation	3 months ago
Jason Ish	d3c08b9643	doc: upgrade guide for dns logging changes ... Bug: #6281	3 months ago
Sascha Steinbiss	53c62432c6	doc: update MQTT configuration	3 months ago
Shivani Bhardwaj	c66f1f4488	doc: add note about datasets string memcaps ... Bug 3910	3 months ago
Victor Julien	afc318737a	doc/userguide: document threshold backoff type	4 months ago
Victor Julien	e362a01f8d	doc/userguide: document new threshold config options	4 months ago
Victor Julien	405491c3fc	detect/detection_filter: add support for track by_flow	4 months ago
Victor Julien	3f04af7c7f	doc: add thresholding by_flow	4 months ago
Jeff Lucovsky	01e20c91fb	doc/transform: Correct typo	4 months ago
Jeff Lucovsky	d205ff82d0	doc/transform: Describe the from_base64 transform ... Issue: 6487 Document the new transform and indicate that it's the preferred way to perform base64 decoding (preferred over base64_decode)	4 months ago
Philippe Antoine	c9ce43b31e	output: configurable payload_length field for alerts ... Ticket: 7098	4 months ago
Victor Julien	3d059611c3	detect: add tls.alpn keyword ... Ticket: #7108.	4 months ago
Victor Julien	c79a382e42	eve/tls: log ALPN for client and server ... Part of the extended logging. Logs `client_alpns` and `server_alpns` arrays in the tls object. Ticket: #7055.	4 months ago
Philippe Antoine	ae72376ebe	detect/snmp: move keywords to rust ... Ticket: 4863 On the way, convert unit test DetectSNMPCommunityTest to a SV test. And also, make snmp.pdu_type use a generic uint32 for detection, allowing operators, instead of just equality.	4 months ago
Lukas Sismis	bd9608771e	doc: port user install and build instruction from master-6.0.x ... Ticket: #6686	4 months ago
Lukas Sismis	521d1cb8e7	doc: update eBPF compilation instructions ... Ticket: #6599	4 months ago
Victor Julien	8b42182fee	doc/userguide: document iprep isset/isnotset	4 months ago
Victor Julien	2f74d435d3	doc/userguide: add more operators to iprep	4 months ago
Victor Julien	50ef646d45	doc/userguide: add noalert/alert keyword docs	4 months ago
Victor Julien	c83e3285ae	doc/userguide: give pcre1 to pcre2 proper heading	4 months ago
Juliana Fajardini	43b998aa73	userguide/upgrade: add note about alerts' increase ... With triggering stream reassembly early, since for certain types of rules there may be more alerts triggered - even in IPS mode, make this clear in the upgrading section. Bug #7026	4 months ago
Philippe Antoine	82c03f72c3	enip: convert to rust ... Ticket: 3958 - transactions are now bidirectional - there is a logger - gap support is improved with probing for resync - frames support - app-layer events - enip_command keyword accepts now string enumeration as values. - add enip.status keyword - add keywords : enip.product_name, enip.protocol_version, enip.revision, enip.identity_status, enip.state, enip.serial, enip.product_code, enip.device_type, enip.vendor_id, enip.capabilities, enip.cip_attribute, enip.cip_class, enip.cip_instance, enip.cip_status, enip.cip_extendedstatus	4 months ago