suricata

Commit Graph

Author	SHA1	Message	Date
Juliana Fajardini	47243c0839	userguide: dynamically determine copyright date This uses the date of doc generation to determine the copyright date for the trailing date. Based on Jeff Lucovsky solution. (cherry picked from commit `e0c8dba7ac`)	3 years ago
Juliana Fajardini	4f9c600bed	userguide: explain alert queue behavior and stats Added sections along packet-alert-max config section explaining packet alert queue overflow (when Suri reaches packet alert max), when alerts are discarded etc. Since from the user perspective it shouldn't matter how we process the alert queue, the term "replace" is used, even though there's not exactly a replacing action happening, with the queue bein pre-processed before being appended to the Packet. Also described the associated stats and added an explanation on when to change packet-alert-max. Task #5178 (cherry picked from commit `1956dc3d5d`)	3 years ago
Juliana Fajardini	9a1a439bd6	doc/userguide: explain packet-alert-max config Task #4207 (cherry picked from commit `49542d0f1b`)	3 years ago
Jason Ish	746f0236f5	doc/userguide: document ftp max-line-length (cherry picked from commit `7d6bc60abb`)	3 years ago
Victor Julien	6e5b7199cf	doc/smb: add resource limits section (cherry picked from commit `976748b777`)	3 years ago
Jeff Lucovsky	1306dbf268	doc/yaml: Signal-termination option description (cherry picked from commit `93842aa14a`)	3 years ago
Shivani Bhardwaj	0e9f42c744	doc/xbits: clarify noalert usage	3 years ago
Jeff Lucovsky	00ab84fd63	doc: Describe per-thread stack size config setting Issue: 4550 This commit documents the new per-thread stack-size setting. Some systems have a small default value that is not suitable for Suricata's multi-threaded architecture and adjustment may be required. (cherry picked from commit `117e11b0ae`)	3 years ago
Shivani Bhardwaj	45745ed2ea	doc: add usage of flowbits OR op Ticket 5130 (cherry picked from commit `015c9fe1e3`)	3 years ago
Odin Jenseg	89f453f7e7	doc/eve-json-format/dns: Describing Z-bit (cherry picked from commit `2a5d79e426`)	4 years ago
Juliana Fajardini	30b1e221ce	doc/lua-functions: add sha items to SCFileInfo doc (cherry picked from commit `751906b71d`)	4 years ago
Philippe Antoine	590e917e94	http2: document HTTP1 keywords enabling For HTTP signatures to match on HTTP2 traffic if configure option app-layer.protocols.http2.http1-rules is enabled	4 years ago
Philippe Antoine	b96f9c0dd5	doc: update sphinx api to use add_css_file instead of deprecated add_stylesheet (cherry picked from commit `95f225e8fb`)	4 years ago
Jason Ish	029e3114b8	doc/quickstart: use new test url that works Replace http://testmyids.org with http://testmynids.org/uid/index.html, as testmyids.org now always redirects to https. (cherry picked from commit `560974b2db`)	4 years ago
Josh Stroschein	0eaa64aad5	doc: update installation documentation for CentOS and Fedora (cherry picked from commit `7ece0ac31f`)	4 years ago
Philippe Antoine	eb2a5587fb	http: makes decompression time limit configurable (cherry picked from commit `a04b5566a6`)	4 years ago
Jeff Lucovsky	95df464ba8	doc/lua: Lua API name consistency This commit updates the documentation of the SCFlow* function names available to Lua scripts. Formerly, they used the prefix "Sc"; now they use "SC". (cherry picked from commit `25e9483168`)	5 years ago
Victor Julien	0ad5a38fb4	ci: buildbot is decommissioned, so remove prscript refs (cherry picked from commit `372fc26739`)	5 years ago
Sascha Steinbiss	773545e6d9	doc: build all manpages (cherry picked from commit `f78f444a5e`)	5 years ago
Kirby Kuehl	2a8571b3f4	doc: fix URL for unix-socket python example (cherry picked from commit `5499a6f7cd`)	5 years ago
Philippe Antoine	096dce4bba	http2: allow filestore to work with HTTP2	5 years ago
Philippe Antoine	4e242645be	doc: explicit header normalization further And their concatenation as described in RFC 2616	5 years ago
Philippe Antoine	6b30890de9	doc: http.uri.raw has no spaces as they are in the protocol cf bug #2881	5 years ago
Victor Julien	7b4ac8dbab	doc/userguide: update http keywords	5 years ago
Victor Julien	ca47d75c80	doc/userguide: explain --strict-rule-keywords	5 years ago
Jeff Lucovsky	a18a9d3046	doc: New sticky buffer icmpv4.hdr	5 years ago
Phil Young	76de981574	napatech: Added comment indicating that hba will be deprecated HBA will be deprecated in Suricata 7	5 years ago
Jason Ish	3030a3da18	doc: provide eve 1 deprecation date	5 years ago
Victor Julien	c95850c6ce	doc/rules: document config rule option	5 years ago
Jeff Lucovsky	6f9b7e052a	doc/eve: Update threaded filename examples	5 years ago
Jason Ish	f70e1f571e	doc/userguide: add info about --set and lists	5 years ago
Jason Ish	69fffb2dc4	doc/userguide: include man page even when not including pdf Fix a mistake in Makefile.am where the man page was only being added to the distribution if the PDF was also created. It should be included even if the PDF cannot be included.	5 years ago
Shivani Bhardwaj	87617b200c	doc/datasets: add info about memcap and hashsize	5 years ago
Jason Ish	7d44e80a50	doc: document removal of unified2 And suggest an alternate tool, Meer if compatibility with Barnyard2 style databases is required. Redmine ticket: https://redmine.openinfosecfoundation.org/issues/3497	5 years ago
Jason Ish	e71f2b22fa	doc: add removal of individual json loggers Add link to multiple eve instances as a replacement for this feature.	5 years ago
Philippe Antoine	9b5c923327	http: disables lzma by default for HTTP	5 years ago
Victor Julien	e1ecb7dc41	doc/datasets: explain reloads, general improvements	5 years ago
Simon Dugas	48da18b081	doc: dns - document additional fields in eve event Documentation of additional fields for soa and sshfp. Also some minor doc fixes and updates.	5 years ago
Jeff Lucovsky	06f41f608c	doc: Improve grammar, spelling and clarifications This commit improves the overall documentation's grammar, spelling, and adds clarifications where needed.	5 years ago
jason taylor	b21160a6e3	doc: http.host keyword note for matching on port Signed-off-by: jason taylor <jtfas90@gmail.com>	5 years ago
Roland Fischer	de7c7eeff0	doc: Add dev code-style	5 years ago
Odin Jenseg	4549505418	doc/userguide: fix outdated xdp info	5 years ago
Philippe Antoine	999af4f62a	http2: adds documentation	5 years ago
James Dutrisac	8d5e54c046	pcap: recusively reading pcaps / documentation Changes to doc/userguide/partials/options.rst for feature 2363 (reading pcaps recursively)	5 years ago
Sascha Steinbiss	4e1a41a17d	output-json: add MAC address output This commit adds MAC address output to the EVE-JSON format. We follow the remarks made in Redmine ticket #962: for packets, log MAC src/dst as a scalar field in EVE; for flows, log MAC src/dst as lists in EVE. Field names are different between flow and packet context to avoid type confusion (src_mac vs. src_macs). Configuration approach and JSON representation is taken from previous GitHub PR #2700.	5 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	5 years ago
Jeff Lucovsky	a5d30a3220	doc/output: Document multithreaded eve option	5 years ago
Philippe Antoine	1569f3e349	transform: adds url_decode keyword Fixes https://redmine.openinfosecfoundation.org/issues/2689 Adds a new source file to handle this keyword. And modifies documentation, Makefile, and registration accordingly. url_decode decodes url-encoded data, ie replacing '+' with space and '%HH' with its value.	5 years ago
Victor Julien	00cc3c7374	eve/ssh: change hassh logging format Elastic search didn't accept the 'hassh' and 'hassh.string'. It would see the first 'hassh' as a string and split the second key into a object 'hassh' with a string member 'string'. So two different types for 'hassh', so it rejected it. This patch mimics the ja3(s) logging by creating a 'hassh' object with 2 members: 'hash', which holds the md5 representation, and 'string' which holds the string representation.	5 years ago
Tristan Fletcher	6cbb4d4909	doc: fix spelling in flowbits image	5 years ago
Victor Julien	e04d48c8c8	doc/userguide: fix outdated mpm info	5 years ago
Victor Julien	04d88e7012	doc/suricata-update: fix typo and do minor cleanups Thanks to showipintbri PR 4465.	5 years ago
Jeff Lucovsky	901fbae7b9	doc: Add byte_math documentation	5 years ago
Jeff Lucovsky	496306e6a9	doc: update stream-depth description	5 years ago
Jeff Lucovsky	ec07f58705	doc: update file-store stream depth description	5 years ago
Vadym Malakhatko	a80f705d4b	userguide: add documentation for Hassh usage 1. Rules keywords 2. Json keywords 3. Usage in lua 4. Enabling in configuration file	5 years ago
Jeff Lucovsky	b116a56a32	doc: Correct typos	5 years ago
Jeff Lucovsky	59cc3c6281	doc: Update byte_extract doc	5 years ago
Jeff Lucovsky	297f91479e	doc: Fix spelling error	5 years ago
Victor Julien	06f414d66d	doc/manpage: improve intro, add examples	5 years ago
Victor Julien	75727c05e0	doc/manpage: add --reject-dev option	5 years ago
Victor Julien	82ac72782d	doc/userguide: update app-proto list	5 years ago
Victor Julien	e6330c354d	doc/userguide: list valid rule actions	5 years ago
Jeff Lucovsky	5e4aa5b851	doc: Improve tos description This commit improves the description of the `tos` keyword by emphasizing that the value used should adhere to the guidelines in RFC2474. Instead of specifying the DSCP value directly, right shift the DSCP value and use that.	5 years ago
Jeff Lucovsky	3005dca3fd	doc: pcrexform documentation	5 years ago
Jason Ish	a77662bdbf	userguide: remove old drop-log documentation Redmine issue: https://redmine.openinfosecfoundation.org/issues/2381	5 years ago
Jason Ish	8997a114cb	userguide: RDP now enabled by default Redmine issue: https://redmine.openinfosecfoundation.org/issues/3255	5 years ago
Jason Ish	3eb0461abd	userguide: SIP now enabled by default Redmine issue: https://redmine.openinfosecfoundation.org/issues/3256	5 years ago
Victor Julien	d0526e71c0	doc/userguide: add IPS with BPF info, minor cleanups	5 years ago
Jason Ish	6b8320d1c0	doc: document file-store v1 to v2 configuration changes	5 years ago
Jason Ish	6850dbc852	suricata.yaml: remove filestore v1 configuration	5 years ago
Victor Julien	e5fd47dcfd	doc/devguide: create basic layout Issue: #3343	5 years ago
Jason Ish	0dd1b2a616	doc: typo: http.server_body should be http.response_body Thanks to Jason Williams for pointing this out.	5 years ago
Victor Julien	a611ae2102	doc/perf: minor improvements	5 years ago
Andreas Herz	1d9db2b5f9	doc: add performance analysis section	5 years ago
Sascha Steinbiss	5598ff5bb3	doc/install: refer to buster as Debian stable	5 years ago
Todd Mortimer	6b4d32c6bb	doc: Update documentation for by_rule and by_both thresholds.	5 years ago
Jeff Lucovsky	5f71e7a371	doc/devguide: Submission and style This commit adds code submission and coding style guidelines to the devguide. Most of the material is a straight port from the wiki but there have been some content modifications and additions.	5 years ago
Jason Ish	752e4828d7	devguide: include sources in EXTRA_DIST Required for distcheck to pass, and required to build docs from a dist archive.	5 years ago
Victor Julien	e97cdb48f3	decode/teredo: implement port support Implement support for limiting Teredo detection and decoding to specific UDP ports, with 3544 as the default. If no ports are specified, the old behaviour of detecting/decoding on any port is still in place. This can also be forced by specifying 'any' as the port setting.	5 years ago
Jeff Lucovsky	4ad6c5421a	doc: fix documentation typos	5 years ago
Jeff Lucovsky	bc01392e93	doc: Update byte_test documentation	5 years ago
Frank Honza	1c8943dedd	add RFB parser This commit adds support for the Remote Framebuffer Protocol (RFB) as used, for example, by various VNC implementations. It targets the official versions 3.3, 3.7 and 3.8 of the protocol and provides logging for the RFB handshake communication for now. Logged events include endpoint versions, details of the security (i.e. authentication) exchange as well as metadata about the image transfer parameters. Detection is enabled using keywords for: - rfb.name: Session name as sticky buffer - rfb.sectype: Security type, e.g. VNC-style challenge-response - rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ... The latter could be used, for example, to detect brute-force attempts on open VNC servers, while the name could be used to map unwanted VNC sessions to the desktop owners or machines. We also ship example EVE-JSON output and keyword docs as part of the Sphinx source for Suricata's RTD documentation.	5 years ago
Victor Julien	ccfdcb55fb	devguide: document new app-layer retvals	5 years ago
Philippe Antoine	6251deae21	doc: adds doc for ipv4.hdr signature keyword	5 years ago
Philippe Antoine	1cd314c500	detect: adds icmpv6.mtu keyword	5 years ago
Jeff Lucovsky	e14447d594	docs/napatech: Correct typo	5 years ago
Shivani Bhardwaj	c5cee05169	doc: Fix typo Generate -> Generator	5 years ago
Shivani Bhardwaj	7b1699c5a8	doc: Add chassis for dev docs Closes redmine ticket 3344.	5 years ago
Philippe Antoine	8396333493	detect: adds icmpv6.hdr keyword	5 years ago
Philippe Antoine	af1361a988	doc: add missing documentation for ipv6.hdr keyword	5 years ago
Jason Ish	d3f6a95b56	doc: removed unified2 output	6 years ago
Jeff Lucovsky	8c132c0b87	doc: Correct RST quote usage Corrects misplaced backticks preventing proper formatting of `mpm-algo` section.	6 years ago
Jeff Lucovsky	3385859176	doc/userguide: Update for dump-features	6 years ago
Phil Young	3fbcacf9a8	napatech: documentation hardware based bypass support Napatech hardware bypass support enables Suricata to utilize capabilities of Napatech SmartNICs to selectively bypass flow-based traffic.	6 years ago
Shivani Bhardwaj	700eebaecc	doc/conf: Update copyright and regex for version Make the new regex in compliance with the modern autoconf syntax. Closes redmine ticket #3423	6 years ago
jason taylor	1666bc0ad1	doc: minor capitalization fix Signed-off-by: jason taylor <jtfas90@gmail.com>	6 years ago
jason taylor	4f7dc4f136	doc: add bsize documentation and rule example Signed-off-by: jason taylor <jtfas90@gmail.com>	6 years ago
Daisu	fccdb1c642	doc/commandline: -i option is useable several times	6 years ago
Steven Hostetler	4ac5ab00b7	doc/install: fix geoip typo	6 years ago

1 2 3 4 5 ...

626 Commits (suricata-6.0.20)