suricata

Commit Graph

Author	SHA1	Message	Date
Jeff Lucovsky	5a6e68285b	doc/netmap: Describe Netmap IPS usage Issue: 5512 This commit summarizes Netmap usage with Suricata's IPS mode.	2 years ago
Jason Ish	9d653512f9	doc/userguide: update bittorrent-dht eve examples Update the bittorrent-dht examples using real log records with peers and nodes broken down into objects.	2 years ago
Jason Ish	065f3ab9f1	doc: rename bittorrent-dht to bittorrent_dht in eve output	2 years ago
Jason Ish	0ea9ba66d1	userguide/eve-log: remove mentions of requiring Rust Rust is required to build now.	2 years ago
Aaron Bungay	d166c48d28	docs: update for bittorrent-dht app-layer	2 years ago
Philippe Antoine	a003640ecf	security: prevents process creation with setrlimit NPROC. So that, if Suricata wants to execve or such to create a new process the OS will forbid it so that RCE exploits are more painful to write. Ticket: #5373	2 years ago
Richard McConnell	7f4c1d5e2f	doc/systemd: add documentation for sd_notify	2 years ago
Eric Leblond	9fb0137d9d	doc: add reference to ipaddr in IP matching	2 years ago
Eric Leblond	3bd48d9336	detect: doc link for ip.src and ip.dst	2 years ago
Eric Leblond	da8b16eaeb	doc: add ip.dst and ip.src doc	2 years ago
Eric Leblond	3599cbf1c4	doc: document new dataset types Feature: #5383	2 years ago
Eric Leblond	a1a22cccd2	doc: document dataset-lookup Ticket: #5184	2 years ago
Eric Leblond	20973e9e6b	doc: add dataset-clear command Ticket: #5184	2 years ago
Eric Leblond	c5559cb68f	doc: document dataset-dump command Ticket: #5184	2 years ago
Victor Julien	2f6c014f70	doc/devguide: update packet (de)alloc in unittests	2 years ago
Lukas Sismis	37cf365e19	docs: remove outdated constraint of negation support for ssl_state Commit `487cdda93d` adds negation support for the SSL state.	2 years ago
Juliana Fajardini	e4b46e0763	doc/acknowledgements: add a few more names Added some names of known contributors to the documentation	2 years ago
Juliana Fajardini	3c25185e0b	devguide: add section about stale tickets policy Just to set the right expectations, and to have it registered for us, too.	2 years ago
Shivani Bhardwaj	2a0cb1f3da	doc: update base64_decode notes	2 years ago
Lukas Sismis	e101384e7b	transversal: remove suricata-ids.org references	2 years ago
Lukas Sismis	a4a69c3e71	doc/dpdk: add IPS setup docs for DPDK mode Ticket: #5511	2 years ago
Eric Leblond	f46f895e8d	rust/smb: import NT status code for Microsoft doc This patch updates the NT status code definition to use the status definition used on Microsoft documentation website. A first python script is building JSON object with code definition. ``` import json from bs4 import BeautifulSoup import requests ntstatus = requests.get('https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55') ntstatus_parsed = BeautifulSoup(ntstatus.text, 'html.parser') ntstatus_parsed = ntstatus_parsed.find('tbody') ntstatus_dict = {} for item in ntstatus_parsed.find_all('tr'): cell = item.find_all('td') if len(cell) == 0: continue code = cell[0].find_all('p') description_ps = cell[1].find_all('p') description_list = [] if len(description_ps): for desc in description_ps: if not desc.string is None: description_list.append(desc.string.replace('\n ', '')) else: description_list = ['Description not available'] if not code[0].string.lower() in ntstatus_dict: ntstatus_dict[code[0].string.lower()] = {"text": code[1].string, "desc": ' '.join(description_list)} print(json.dumps(ntstatus_dict)) ``` The second one is generating the code that is ready to be inserted into the source file: ``` import json ntstatus_file = open('ntstatus.json', 'r') ntstatus = json.loads(ntstatus_file.read()) declaration_format = 'pub const SMB_NT%s:%su32 = %s;\n' resolution_format = ' SMB_NT%s%s=> "%s",\n' declaration = "" resolution = "" text_max = len(max([ntstatus[x]['text'] for x in ntstatus.keys()], key=len)) for code in ntstatus.keys(): text = ntstatus[code]['text'] text_spaces = ' ' * (4 + text_max - len(text)) declaration += declaration_format % (text, text_spaces, code) resolution += resolution_format % (text, text_spaces, text) print(declaration) print('\n') print(''' pub fn smb_ntstatus_string(c: u32) -> String { match c { ''') print(resolution) print(''' _ => { return (c).to_string(); }, }.to_string() } ''') ``` Bug #5412.	2 years ago
jason taylor	db5cf1f8f9	userguide: Add rule file globbing option details Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
Juliana Fajardini	7b0008d4f0	userguide: add section about exception policies This describes briefly what the exception policies are, what is the engine's behavior, what options are available and to which parts are they implemented. Task #5475 Task #5515	2 years ago
Juliana Fajardini	6f294f2f2d	userguide: minor rewording and typo fixes Some of these were recently introduced, some were highlited after the applayer sections got merged. Some paragraphs seem to have been changed due to trying to respect character limits for lines. Also includes a typo pointed out by one of our community members via Discord.	2 years ago
Jeff Lucovsky	33c424f9ed	doc/byte_math: Add byte_math differences with snort Issue: 5077	2 years ago
Jeff Lucovsky	192a31c74e	doc: Fixup byte* entries to display tables properly	2 years ago
Philippe Antoine	390cf9248f	detect: adds flow.age keyword Ticket: #5536	2 years ago
Philippe Antoine	af40873127	pgsql: config limit maximum number of live transactions As is done for other protocols Ticket: #5527	2 years ago
Eric Leblond	1b24f4d357	doc: document landlock feature	3 years ago
Philippe Antoine	fe91506320	doc/http2: suricata.yaml max-streams parameter Ticket: #4949	3 years ago
Juliana Fajardini	bbd968c738	exceptions: add reject support to exception policy This enables the usage of 'reject' as an exception policy. As for both IPS and IDS modes the intended result of sending a reject packet is to reject the related flow, this will effectively mean setting the reject action to the packet that triggered the exception condition, and then dropping the associated flow. Task #5503	3 years ago
Philippe Antoine	5ef259722b	dhcp: adds renewal-time keyword Ticket: #5507	3 years ago
Philippe Antoine	6faf6299e0	dhcp: adds rebinding-time keyword Ticket: #5506	3 years ago
Juliana Fajardini	ef54f36e34	userguide: briefly introduce exception policy opts Added them in the configuration section so folks can be more aware of them, while a more complete documentation isn't around. Related to Task #5475	3 years ago
Juliana Fajardini	3c74e443bd	userguide: update defrag settings options We were still mentioning that there were only three options.	3 years ago
Juliana Fajardini	0cc040cf61	userguide: merge sections about AppLayer Parsers We had two sections under the suricata.yaml configuration section describing settings for application layer parsers. This merges them into one and also fixes a few subsection title levels. Task #5364	3 years ago
Shivani Bhardwaj	a77977ec62	doc: add description for tls.random	3 years ago
jason taylor	c29942c029	userguide: update dsize documentation/examples Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Philippe Antoine	461725a9bf	dhcp: adds leasetime keyword As it is logged Ticket: #5435	3 years ago
Shivani Bhardwaj	2c4d6b33ae	doc/conf: fix sphinx language setting sphinx-build 5.1.1 and above throws a warning which is treated as an error while building. Invalid configuration value found: 'language = None'. Update your configuration to a valid language code. Falling back to 'en' (English).	3 years ago
Benjamin Wilkins	3b1b9a32fb	doc: Document SCByteVarGet lua function Add documentation for accessing results from byte_extract and byte_math in lua match functions Issue: 2871	3 years ago
Philippe Antoine	5c7b5c5fb5	krb: detection for ticket encryption As is done for logging. Ticket: #5442	3 years ago
Jufajardini Reichow	61f9f0df55	userguide/rules/meta: minor formatting adjustments	3 years ago
Jufajardini Reichow	45f14bb97c	userguide/rules: explain sid uniqueness within gid While Suri will throw an error if two signatures have the same `sid` and no `gid`, or same `sid` and same `gid`, it will just accept same `sid` for different `gid`s. Related to Task #5441	3 years ago
jason taylor	87990b138c	doc: update priority wording userguide meta Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	a7d739a05b	doc: update to 80 char formatting userguide meta Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	9bd55ff81b	doc: metadata information update userguide meta Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	563dc66837	doc: update priority information userguide meta Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	f73a60eb89	doc: update reference section in userguide meta Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago

1 2 3 4 5 ...

728 Commits (df45fc9e97f49398d4dd0994c436bd38254689ee)