BuildBot Place to collect tickets about BuildBot ideas, suggestions, etc. 36% 11 issues (4 closed — 7 open) Related issues Feature #633: open buildbot instance to the public Feature #655: openbsd 5.2 buildslave Feature #657: buildbot build with --enable-debug-validation Feature #658: buildbot pcap run with --enable-debug-validation Feature #661: buildbot addition of missing OSs Feature #913: CUDA build Feature #966: scan-build support in the buildbot Feature #974: valgrind leak check Feature #1010: dns fuzzer Feature #1011: integrate fuzzer into buildbot
Documentation Place to collect tickets about missing docs, doc errors 73% 41 issues (30 closed — 11 open) Related issues Feature #589: ssl_state keyword not documented Feature #590: document pulledpork for rule updates Feature #595: IPv4 IPv6 keword description/tutorial Feature #631: add user/group info to yaml doc Feature #642: document pkt acquisition API Feature #643: unix socket: document protocol Feature #644: unix socket: document adding commands Feature #645: unix socket: user guide Feature #756: document http_host and http_raw_host Feature #1233: Documentation for each keyword in stats.log file. Feature #1612: Sphinx for docs Feature #1613: document sphinx switch Feature #1620: User guide conversion to Sphinx: 8. Suricata Rules Feature #1621: Docs: Convert Section 6. Command Line Options Feature #1622: Docs: Convert Section 9. Rule Management with Oinkmaster Feature #1623: Docs: Convertion Section 10. Performance Feature #1624: Docs: Convert Section 11. Configuration Feature #1625: Docs: Convert Section 12. Reputation Feature #1626: Docs: Convert Section 13. Init Scripts Feature #1627: Docs: Convert Section 14: Setting up IPS/Inline for Linux Feature #1628: Docs: Convert Section 15. Output Feature #1629: Docs: Convert Section 16. File Extraction Feature #1630: Docs: Convert Section 18. Public Data Sets Feature #1631: Docs: Convert Section 20. Using Capture Hardware Feature #1658: Docs: Add Installation Guides to the Sphinx Documentation Feature #1685: Docs: To add the installation sheet for openSUSE distro Feature #1691: Docs: Convert windows docs Feature #1747: document rate_filter Feature #1892: rule docs should include example rules Feature #1974: DNP3: document lua support Feature #2021: doc: sha256 filesum extraction missing in documentation Feature #2081: document byte_test Feature #2082: document byte_jump Feature #2083: document byte_extract
Packaging/PPA 79% 24 issues (19 closed — 5 open) Related issues Feature #695: Ubuntu PPA Doesn't Install Any Rules Feature #699: packaging for Mac Feature #734: Ubuntu PPA should be compiled with unix socket support enabled Feature #905: PPA packaging - log directories check Feature #949: SUSE automatic package building system Feature #1216: Debian repository Feature #1819: Silent installer for suricata windows Feature #1822: Support for hiredis in Ubuntu PPA
QA 50% 4 issues (2 closed — 2 open) Related issues Feature #1369: json schema Feature #1553: AppVeyor - TravisCI for Windows builds Feature #1963: travis-ci: OS X support
Soon Placeholder for tickets that we'll hopefully get into the next major release. 7% 89 issues (1 closed — 88 open) Related issues Feature #249: Configure host-os-policy from a file, like snorts host_attribute.xml Feature #352: Switching to message queuing system for output Feature #425: Inspect the effects of mixing threshold and detection filters etc.. Feature #719: finish/enable smb2 app layer parser Feature #744: Teredo configuration Feature #807: Implement CONNECT support Feature #880: memcap http parser Feature #902: VLAN host table support Feature #933: add a IPv6 ( RFC2460 recommended order of EH )rule to decoder events rules Feature #997: Add libhtp event for every htp_log() that needs an event. Feature #1025: 1.4.6: seperate #ifdef UNITTEST code into their own files Feature #1125: smtp: improve protocol detection Feature #1274: ssh events Feature #1348: OOBE -6- increasing max-pending-packets default value Feature #1350: OOBE -8- ship pre-configured oinkmaster and pulledpork configs Feature #1585: unix-socket: improve information regarding ruleset Feature #1600: flash file decompression for file_data Feature #1604: mixed IDS/IPS mode Feature #1678: open umask settings or make them configurable Feature #1741: flow: use capture methods flow hash Feature #1748: lua: expose tx in alert lua scripts Feature #1758: Cleanup unit tests. Feature #1807: Cisco HDLC Decoder Feature #1851: add verbosity level description to the help command Feature #1863: smtp: improve pipelining support Feature #1879: eve: optionally add 'flow' record to alerts Feature #1970: json: make libjansson mandatory Feature #1971: lua: make mandatory Feature #1995: fast.log should show if packet has been dropped or rejected Feature #2095: eve: http body in alert event Feature #2138: Create a sample systemd service file. Feature #2142: filesize: support other units than only bytes
TBD To be determined -- place holder for tickets that are not prioritized/scheduled yet 16% 326 issues (49 closed — 277 open) Related issues Feature #120: Capture full session on alert Feature #121: Alert on domain name look up, capture traffic for corresponding IP Feature #266: log http raw request for network forensic Feature #273: IRC protocol detection support Feature #276: Libcap support for dropping privileges Feature #294: Limit inspection of a stream and/or rule... Feature #328: Traceability and QA with regards to rules loaded Feature #365: expose interface(unix socket command) to reset tcp connection Feature #385: Configuration option to log all known (pcap) data for a stream when an alert fires Feature #432: PCAP-NG support Feature #448: dlp: md5sum based on part of files Feature #465: benchmark runmode Feature #473: pcap log: alert log with packet indexes Feature #511: Port indepedent protocol identification Feature #524: detect double encoding in URI Feature #535: new keywords - time , day Feature #544: Live traffic decryption Feature #547: libinjection -- sqli library Feature #548: Use bloomfilter for filemd5 Feature #550: Extract file attachments from FTP Feature #584: luajit: expose file buffers Feature #596: rule profiling: multiple outputs per run Feature #609: Active Response in inline mode (like react in snort 2.9+) Feature #610: track by_src exluding port Feature #614: Rate limiting messages Feature #641: Flowbits group for ORing Feature #646: smb log feature to be introduced Feature #659: Update IP reputation from unix socket. Feature #660: Update host policy from unix socket Feature #682: Add DEP and ASLR to Windows Binary Feature #691: RF: Telnet decoding protocol over Suricata Feature #713: tls.fingerprint - file usage Feature #716: configurable packet_stats.csv and packet_stats.log Feature #721: full nfq zero copy mode Feature #723: Add support for smb 3 Feature #724: Prevent resetting in UNIX socket mode Feature #728: Add support for OpenCL Feature #731: generic streaming parser api Feature #735: Introduce content_len keyword Feature #741: Introduce endswith keyword Feature #742: startswith keyword Feature #745: Tunnel configuration Feature #748: URL Reputation Feature #776: Add smtp_envelope and smtp_header keywords Feature #783: LuaJIT be able to return various messages for a single script. Feature #793: Suricata.log + exit stats - add % dropped Feature #808: Support the new GSO-avoidance NFQ feature Feature #811: Pcap extract of matching pattern. Feature #816: TCP SACK: limits per stream Feature #821: Conditional logging Feature #843: Custom http logging filter functionality Feature #845: Memory consumption in stats.log Feature #850: Introduce memcap config options for htp in suricata.yaml Feature #870: luajit: global vars Feature #884: add man pages Feature #886: bromagic support Feature #931: cygwin64 Feature #936: support tzsp protocol Feature #947: dynamic allocation of thread queues Feature #960: persistent TCP resets Feature #962: Can I log the mac address of the source? Feature #984: libhtp HTP_AUTH_UNRECOGNIZED Feature #1002: Possible to disabling/bypassing a rule by a specific source ip and a destination ip? Feature #1005: conditional logging Feature #1006: transformation api Feature #1015: add chained content info to rule analysis Feature #1017: Add support for content-range Feature #1065: Introduce vlan id keyword Feature #1088: Detect virtual machines during build/start Feature #1095: Integration of support for STIX-based indicators Feature #1096: Log TLS client certificate Feature #1099: keyword: file_name keyword Feature #1100: keyword: file_ext keyword Feature #1132: set rpath for libs not in the default linker paths Feature #1139: show alert.signature_id information in event_type drop eve.json Feature #1140: IP-Address white list implementation for IPS mode (without disable a rule global) Feature #1149: add systemd service Feature #1191: EVE log does not support customformat Feature #1194: Implement http_args keyword to match http arguments - query string or body Feature #1198: more compact dns logging Feature #1199: LDAP support Feature #1201: file-store metadata in JSON format Feature #1203: TCP Fast Open support Feature #1215: journald logging support Feature #1229: Suricata alerts in CEF Format Feature #1234: nfqueue: use mnl API Feature #1239: Best effort TCP stack Feature #1245: Add "drop-only" and "alert-only" option for pcap-log Feature #1249: http/dns ip-reputation alike technique Feature #1250: Multipath TCP Feature #1270: Request: Adding several logging enhancements Feature #1283: support for snort's file_data keyword Feature #1290: handle SIGHUP signal Feature #1300: profiling: per flow recording of profiling data Feature #1320: packet content in alert msg Feature #1323: automated eve.json rotation Feature #1380: JSON and Unified2 output "payload" does not contain full (or real in the case of Unified2) packets for session Feature #1386: offline: add pcap file name to EVE Feature #1389: suppress by host Feature #1458: unix-socket - make rule load errs available Feature #1468: File extension : fileext rule protocol support Feature #1469: Use ISO 8601 date/time formats Feature #1476: Suricata Unix socket PCAP processing stats should not need to reset after each run Feature #1478: Active flow counters Feature #1489: Log a message when memcap limit is reached Feature #1505: Show loaded lua scripts during live rule swap or normal start in verbose mode Feature #1520: multitenancy - verbose output clarity Feature #1541: multi-detect - vlan range mapping Feature #1542: dump-config - extend into multi-detect supplied yaml configuration Feature #1545: Add type variable into StatsRecord Feature #1566: ICMPv4 control channel detection Feature #1571: Socket permissions setting in suricata.yaml Feature #1576: http: byte-range support Feature #1579: Support Modbus Unit Identifier Feature #1590: lua: force file magic and md5 lookup from script Feature #1608: Add option to disable JSON escape slash Feature #1655: Gather (develop) external scripts, extensions, addons specific to suricata to the wiki/contrib Feature #1662: Disable action / rule ordering option Feature #1692: files-json.log should contain the full path of the saved file when "file-log" is enabled Feature #1705: hyperscan pcre integration Feature #1710: New socket UNIX command for pcap files Feature #1712: multitenancy: 'lite' tenants Feature #1726: pfring: IPS support Feature #1750: Set Suricata to listen to all network interfaces when using AF_PACKET Feature #1752: Netmap for Windows Feature #1757: URL Reputation Feature #1766: TLS keyword expansion Feature #1767: Support DTLS protocol Feature #1783: Create Suricata buffers to expose L2, L3, and L4 headers to Lua scripts Feature #1794: test suricata rules over unix-socket Feature #1799: netmap: capture drop stats Feature #1828: YARA support Feature #1872: add --list-decoder-protos or similar Feature #1894: concurrent flows counter Feature #1899: Detecting Malicious TCP Network Flows Based on Benford’s Law Feature #1939: Introduce packet/byte counter in stats.log/json for local bypass Feature #1940: Debian Jessie - better mesage when trying to run 2 suricata with afpacket Feature #1947: HTTP2 decoder Feature #1948: allow filestore name configuration options Feature #1949: only write unique files Feature #1950: allow configuration of file-store types Feature #1952: allow pcap reading from stdin Feature #1954: runtime option/flag to disable hardware timestamp support Feature #1956: Add option to re-initialise Lua output scripts Feature #1977: get the os info from TCP HTTP fingerprint Feature #1979: TCP/IP packets normalization/scrubbing Feature #1993: commandline: introduce --enable-all-outputs switch Feature #2015: eve: add fileinfo in alert Feature #2016: doc: improve keywords self documentation Feature #2020: eve: add body of signature to eve.json alert Feature #2054: Extracting HTTPS URL´s from SMTP, currently only HTTP is supported Feature #2055: Optionally logging on files.json - Not log every file, only certain files that are stored and extracted Feature #2062: tls: reimplement tls.fingerprint Feature #2075: Wildcard matching in suricata hex content matching Feature #2076: Strip whitespace from buffers Feature #2084: 编写UDP eve output plugin. Feature #2086: DNS answer for a NS containing multiple name servers should only be one line Feature #2087: Increase verbosity of DNS logging - MX additional records Feature #2092: Improved support for xbits/hostbits - workers runmode Feature #2096: eve: event_type for MODBUS Feature #2107: eve: rotate log output based on size Feature #2114: Redis output: add RPUSH support Feature #2115: Changing interfaces Feature #2127: Rate Limiting by Tracking Both Source & Destination IP Addresses