Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.

cybersecurityidsintrusion-detection-systemintrusion-prevention-systemipsnetwork-monitornetwork-monitoringnsmsecuritysuricatathreat-hunting

You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Victor Julien 9878eca086 file handling: expand filestore keyword ... Filestore keyword by default (... filestore; ... ) marks only the file in the same direction as the rule match for storing. This makes sense when inspecting individual files (filemagic, filename, etc) but not so much when looking at suspicious file requests, where the actual file is in the response. The filestore keyword now takes 2 optional options: filestore:<direction>,<scope>; By default the direction is "same as rule match", and scope is "currently inspected file". For direction the following values are possible: "request" and "to_server", "response" and "to_client", "both". For scope the following values are possible: "tx" for all files in the current HTTP/1.1 transation, "ssn" and "flow" for all files in the session/flow. For the above case, where a suspious request should lead to a response file download, this would work: alert http ... content:"/suspicious/"; http_uri; filestore:response; ...		15 years ago
benches	Initial add of the files.	17 years ago
doc	Add content to ChangeLog and add links to more up to date versions of various docs.	15 years ago
libhtp	libhtp/m4 dir won't be created on CentOS 5.3 by autogen.sh, so work around that by having it in git	15 years ago
m4	Prelude plugin: add detection in configure script	17 years ago
qa	coccinelle: test for invalid size_t printing.	15 years ago
rules	Stream engine: gap handling	15 years ago
src	file handling: expand filestore keyword	15 years ago
.gitignore	Import .gitignore file.	16 years ago
COPYING	Initial add of the files.	17 years ago
ChangeLog	Add content to ChangeLog and add links to more up to date versions of various docs.	15 years ago
LICENSE	import of gplv2 LICENSE	17 years ago
Makefile.am	Add stream-events.rules to distribution.	15 years ago
Makefile.cvs	Initial add of the files.	17 years ago
acsite.m4	Added C99 defs/macros to acsite.m4 for CentOS	17 years ago
autogen.sh	Add initial support for reading packets from a DAG card, we only support reading from a single stream at this time.	16 years ago
classification.config	Import of classification.config	17 years ago
configure.in	Add libmagic detection, linking and a basic API.	15 years ago
depcomp	Update autojunk.sh + build update.	17 years ago
doxygen.cfg	doc: Include htp documentation.	15 years ago
install-sh	Update autojunk.sh + build update.	17 years ago
missing	Update autojunk.sh + build update.	17 years ago
mkinstalldirs	Update autojunk.sh + build update.	17 years ago
reference.config	Add the ET reference.config file as a default	16 years ago
suricata.yaml	Add magic-file example to suricta.yaml.	15 years ago