Project

General

Profile

Roadmap

4.1beta1

about 2 months late (03/23/2018)

99%

85 issues   (84 closed — 1 open)

Related issues
Feature #550: Extract file attachments from FTP
Feature #646: smb log feature to be introduced
Feature #719: finish/enable smb2 app layer parser
Feature #723: Add support for smb 3
Feature #724: Prevent resetting in UNIX socket mode
Feature #735: Introduce content_len keyword
Feature #741: Introduce endswith keyword
Feature #742: startswith keyword
Feature #1006: transformation api
Feature #1201: file-store metadata in JSON format
Feature #1386: offline: add pcap file name to EVE
Feature #1458: unix-socket - make rule load errs available
Feature #1476: Suricata Unix socket PCAP processing stats should not need to reset after each run
Feature #1579: Support Modbus Unit Identifier
Feature #1585: unix-socket: improve information regarding ruleset
Feature #1600: flash file decompression for file_data
Feature #1678: open umask settings or make them configurable
Feature #1948: allow filestore name configuration options
Feature #1949: only write unique files
Feature #2020: eve: add body of signature to eve.json alert
Feature #2062: tls: reimplement tls.fingerprint
Feature #2076: Strip whitespace from buffers
Feature #2142: filesize: support other units than only bytes
Feature #2192: JA3 TLS client fingerprinting
Feature #2199: DNS answer events compacted
Feature #2222: Batch submission of PCAPs over the socket
Feature #2253: Log rule metadata in alert event
Feature #2285: modify memcaps over unix socket
Feature #2295: decoder: support PCAP LINKTYPE_IPV4
Feature #2299: pcap: read directory with pcaps from the commandline
Feature #2303: file-store enhancements (aka file-store v2): deduplication; hash-based naming; json metadata and cleanup tooling
Feature #2352: eve: add "metadata" field to alert (rework of vars)
Feature #2382: deprecate: CUDA support
Feature #2399: eBPF and XDP bypass for AF_PACKET capture method
Feature #2464: tftp logging

BuildBot

Place to collect tickets about BuildBot ideas, suggestions, etc.

40%

10 issues   (4 closed — 6 open)

Related issues
Feature #633: open buildbot instance to the public
Feature #655: openbsd 5.2 buildslave
Feature #657: buildbot build with --enable-debug-validation
Feature #658: buildbot pcap run with --enable-debug-validation
Feature #661: buildbot addition of missing OSs
Feature #966: scan-build support in the buildbot
Feature #974: valgrind leak check
Feature #1010: dns fuzzer
Feature #1011: integrate fuzzer into buildbot

Documentation

Place to collect tickets about missing docs, doc errors

67%

46 issues   (31 closed — 15 open)

Related issues
Feature #589: ssl_state keyword not documented
Feature #590: document pulledpork for rule updates
Feature #595: IPv4 IPv6 keword description/tutorial
Feature #631: add user/group info to yaml doc
Feature #642: document pkt acquisition API
Feature #643: unix socket: document protocol
Feature #644: unix socket: document adding commands
Feature #645: unix socket: user guide
Feature #756: document http_host and http_raw_host
Feature #1233: Documentation for each keyword in stats.log file.
Feature #1612: Sphinx for docs
Feature #1613: document sphinx switch
Feature #1620: User guide conversion to Sphinx: 8. Suricata Rules
Feature #1621: Docs: Convert Section 6. Command Line Options
Feature #1622: Docs: Convert Section 9. Rule Management with Oinkmaster
Feature #1623: Docs: Convertion Section 10. Performance
Feature #1624: Docs: Convert Section 11. Configuration
Feature #1625: Docs: Convert Section 12. Reputation
Feature #1626: Docs: Convert Section 13. Init Scripts
Feature #1627: Docs: Convert Section 14: Setting up IPS/Inline for Linux
Feature #1628: Docs: Convert Section 15. Output
Feature #1629: Docs: Convert Section 16. File Extraction
Feature #1630: Docs: Convert Section 18. Public Data Sets
Feature #1631: Docs: Convert Section 20. Using Capture Hardware
Feature #1658: Docs: Add Installation Guides to the Sphinx Documentation
Feature #1685: Docs: To add the installation sheet for openSUSE distro
Feature #1691: Docs: Convert windows docs
Feature #1747: document rate_filter
Feature #1892: rule docs should include example rules
Feature #1974: DNP3: document lua support
Feature #2021: doc: sha256 filesum extraction missing in documentation
Feature #2081: document byte_test
Feature #2082: document byte_jump
Feature #2083: document byte_extract
Feature #2286: doc: document best practices around handling file extraction

Packaging/PPA

73%

26 issues   (19 closed — 7 open)

Related issues
Feature #695: Ubuntu PPA Doesn't Install Any Rules
Feature #699: packaging for Mac
Feature #734: Ubuntu PPA should be compiled with unix socket support enabled
Feature #905: PPA packaging - log directories check
Feature #949: SUSE automatic package building system
Feature #1216: Debian repository
Feature #1819: Silent installer for suricata windows
Feature #1822: Support for hiredis in Ubuntu PPA
Feature #2150: Support for attaching Suricata to multiple NFQ's using the default startup script

Soon

Placeholder for tickets that we'll hopefully get into the next major release.

5%

69 issues   (0 closed — 69 open)

Related issues
Feature #352: Switching to message queuing system for output
Feature #425: Inspect the effects of mixing threshold and detection filters etc..
Feature #880: memcap http parser
Feature #902: VLAN host table support
Feature #933: add a IPv6 ( RFC2460 recommended order of EH )rule to decoder events rules
Feature #962: Can I log the mac address of the source?
Feature #997: Add libhtp event for every htp_log() that needs an event.
Feature #1025: 1.4.6: seperate #ifdef UNITTEST code into their own files
Feature #1125: smtp: improve protocol detection
Feature #1198: more compact dns logging
Feature #1274: ssh events
Feature #1348: OOBE -6- increasing max-pending-packets default value
Feature #1469: Use ISO 8601 date/time formats
Feature #1604: mixed IDS/IPS mode
Feature #1741: flow: use capture methods flow hash
Feature #1807: Cisco HDLC Decoder
Feature #1851: add verbosity level description to the help command
Feature #1863: smtp: improve pipelining support
Feature #1995: fast.log should show if packet has been dropped or rejected
Feature #2086: DNS answer for a NS containing multiple name servers should only be one line
Feature #2273: engine analysis: enable analysis by default during startup
Feature #2283: turn content modifiers into 'sticky buffers'
Feature #2291: traffic-id: ruleset for traffic classification and bypass
Feature #2292: flow: add icmpv4 and improve icmpv6 flow handling
Feature #2315: eve: ftp logging

TBD

To be determined -- place holder for tickets that are not prioritized/scheduled yet

2%

355 issues   (4 closed — 351 open)

Related issues
Feature #120: Capture full session on alert
Feature #121: Alert on domain name look up, capture traffic for corresponding IP
Feature #249: Configure host-os-policy from a file, like snorts host_attribute.xml
Feature #266: log http raw request for network forensic
Feature #273: IRC protocol detection support
Feature #276: Libcap support for dropping privileges
Feature #294: Limit inspection of a stream and/or rule...
Feature #328: Traceability and QA with regards to rules loaded
Feature #365: expose interface(unix socket command) to reset tcp connection
Feature #385: Configuration option to log all known (pcap) data for a stream when an alert fires
Feature #432: PCAP-NG support
Feature #448: dlp: md5sum based on part of files
Feature #465: benchmark runmode
Feature #473: pcap log: alert log with packet indexes
Feature #511: Port indepedent protocol identification
Feature #524: detect double encoding in URI
Feature #535: new keywords - time , day
Feature #544: Live traffic decryption
Feature #547: libinjection -- sqli library
Feature #548: Use bloomfilter for filemd5
Feature #584: luajit: expose file buffers
Feature #596: rule profiling: multiple outputs per run
Feature #609: Active Response in inline mode (like react in snort 2.9+)
Feature #614: Rate limiting messages
Feature #641: Flowbits group for ORing
Feature #659: Update IP reputation from unix socket.
Feature #660: Update host policy from unix socket
Feature #682: Add DEP and ASLR to Windows Binary
Feature #713: tls.fingerprint - file usage
Feature #716: configurable packet_stats.csv and packet_stats.log
Feature #721: full nfq zero copy mode
Feature #728: Add support for OpenCL
Feature #731: generic streaming parser api
Feature #745: Tunnel configuration
Feature #776: Add smtp_envelope and smtp_header keywords
Feature #783: LuaJIT be able to return various messages for a single script.
Feature #808: Support the new GSO-avoidance NFQ feature
Feature #816: TCP SACK: limits per stream
Feature #821: Conditional logging
Feature #843: Custom http logging filter functionality
Feature #845: Memory consumption in stats.log
Feature #870: luajit: global vars
Feature #884: add man pages
Feature #886: bromagic support
Feature #936: support tzsp protocol
Feature #947: dynamic allocation of thread queues
Feature #960: persistent TCP resets
Feature #984: libhtp HTP_AUTH_UNRECOGNIZED
Feature #1002: Possible to disabling/bypassing a rule by a specific source ip and a destination ip?
Feature #1005: conditional logging
Feature #1015: add chained content info to rule analysis
Feature #1017: Add support for content-range
Feature #1065: Introduce vlan id keyword
Feature #1088: Detect virtual machines during build/start
Feature #1095: Integration of support for STIX-based indicators
Feature #1096: Log TLS client certificate
Feature #1099: keyword: file_name keyword
Feature #1100: keyword: file_ext keyword
Feature #1132: set rpath for libs not in the default linker paths
Feature #1140: IP-Address white list implementation for IPS mode (without disable a rule global)
Feature #1149: add systemd service
Feature #1191: EVE log does not support customformat
Feature #1194: Implement http_args keyword to match http arguments - query string or body
Feature #1199: LDAP support
Feature #1203: TCP Fast Open support
Feature #1215: journald logging support
Feature #1229: Suricata alerts in CEF Format
Feature #1234: nfqueue: use mnl API
Feature #1239: Best effort TCP stack
Feature #1245: Add "drop-only" and "alert-only" option for pcap-log
Feature #1249: http/dns ip-reputation alike technique
Feature #1250: Multipath TCP
Feature #1283: support for snort's file_data keyword
Feature #1290: handle SIGHUP signal
Feature #1300: profiling: per flow recording of profiling data
Feature #1323: automated eve.json rotation
Feature #1380: JSON and Unified2 output "payload" does not contain full (or real in the case of Unified2) packets for session
Feature #1389: suppress by host
Feature #1468: File extension : fileext rule protocol support
Feature #1478: Active flow counters
Feature #1489: Log a message when memcap limit is reached
Feature #1505: Show loaded lua scripts during live rule swap or normal start in verbose mode
Feature #1520: multitenancy - verbose output clarity
Feature #1541: multi-detect - vlan range mapping
Feature #1542: dump-config - extend into multi-detect supplied yaml configuration
Feature #1545: Add type variable into StatsRecord
Feature #1566: ICMPv4 control channel detection
Feature #1571: Socket permissions setting in suricata.yaml
Feature #1576: http: byte-range support
Feature #1590: lua: force file magic and md5 lookup from script
Feature #1608: Add option to disable JSON escape slash
Feature #1655: Gather (develop) external scripts, extensions, addons specific to suricata to the wiki/contrib
Feature #1662: Disable action / rule ordering option
Feature #1710: New socket UNIX command for pcap files
Feature #1712: multitenancy: 'lite' tenants
Feature #1726: pfring: IPS support
Feature #1750: Set Suricata to listen to all network interfaces when using AF_PACKET
Feature #1752: Netmap for Windows
Feature #1757: URL Reputation
Feature #1766: TLS keyword expansion
Feature #1767: Support DTLS protocol
Feature #1783: Create Suricata buffers to expose L2, L3, and L4 headers to Lua scripts
Feature #1794: test suricata rules over unix-socket
Feature #1799: netmap: capture drop stats
Feature #1828: YARA support
Feature #1872: add --list-decoder-protos or similar
Feature #1894: concurrent flows counter
Feature #1899: Detecting Malicious TCP Network Flows Based on Benford’s Law
Feature #1939: Introduce packet/byte counter in stats.log/json for local bypass
Feature #1940: Debian Jessie - better mesage when trying to run 2 suricata with afpacket
Feature #1947: HTTP2 decoder
Feature #1950: allow configuration of file-store types
Feature #1954: runtime option/flag to disable hardware timestamp support
Feature #1956: Add option to re-initialise Lua output scripts
Feature #1970: json: make libjansson mandatory
Feature #1971: lua: make mandatory
Feature #1977: get the os info from TCP HTTP fingerprint
Feature #1979: TCP/IP packets normalization/scrubbing
Feature #1993: commandline: introduce --enable-all-outputs switch
Feature #2015: eve: add fileinfo in alert
Feature #2016: doc: improve keywords self documentation
Feature #2054: Extracting HTTPS URL´s from SMTP, currently only HTTP is supported
Feature #2055: Optionally logging on files.json - Not log every file, only certain files that are stored and extracted
Feature #2092: Improved support for xbits/hostbits - workers runmode
Feature #2096: eve: event_type for MODBUS
Feature #2107: eve: rotate log output based on size
Feature #2115: Changing interfaces
Feature #2127: Rate Limiting by Tracking Both Source & Destination IP Addresses
Feature #2145: Relate directly flowid with certificate file
Feature #2166: output: log only triggering buffers
Feature #2167: eve-ng
Feature #2168: Rules files from Suricata sources (like decoder-events.rules) are packaged as config files and may not be updated on package update.
Feature #2174: Need a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET
Feature #2196: Add flow_id to the file extracted .meta file
Feature #2198: Extend the DNS parser to accept dns_response keyword in signatures
Feature #2200: Dynamically add md5 to blacklist without full restart
Feature #2213: file matching: allow generic file matching / store
Feature #2219: Save pcap only if alert
Feature #2227: more detailed output about number of threads created
Feature #2232: Allow Large value in suricata.yaml file
Feature #2233: Allow log for payload and packet only for defined sid
Feature #2262: Unix Socket Output Configurable Retries and Blocking
Feature #2269: TLS: tls.version: allow negation or comparison
Feature #2277: netinfo: structured information about the network. Output hierarchical network tree in events
Feature #2278: failing better
Feature #2279: TLS 1.3 decoding, SNI extraction and logging
Feature #2280: http: rules that match both request and response
Feature #2281: tcp stream: simpler IDS handling of overlap evasions
Feature #2282: event log aka weird.log
Feature #2284: detect partial file transfers
Feature #2290: lua: expose lua generated buffers to rule lang
Feature #2297: deprecate: dns.log
Feature #2298: pcap: store pcaps in compressed form
Feature #2300: DPDK integration
Feature #2301: netflow: dump records at interval
Feature #2308: threshold/suppress by http_host
Feature #2310: lua: expose xbits
Feature #2311: math on extracted values
Feature #2312: http: parsing for async streams
Feature #2313: save & restore state when suricata restarts
Feature #2314: protocol parser: rdp
Feature #2316: global memcap
Feature #2318: matching on large amounts of data with dynamic updates
Feature #2319: Expose flow lifetime to the rulelanguage
Feature #2323: Applayer support for telnet
Feature #2332: Support for common http response headers - Location and Server
Feature #2342: Write PCAP files directly to Unix Socket
Feature #2343: Add "flush" command to unix socket
Feature #2363: pcap: read directories recursively
Feature #2371: list all available /exposed fields to lua
Feature #2375: Design and implement sensible per-thread capabilities
Feature #2376: deprecate: files-json.log
Feature #2377: deprecate: ssh.softwareversion and ssh.protoversion
Feature #2379: deprecate: Tilera / Tile support
Feature #2380: [discussion] deprecate: 'alert syslog' output
Feature #2381: [discussion] deprecate: 'drop' log output
Feature #2385: deprecate: unified2
Feature #2387: smtp: extend probing parser
Feature #2388: smtp: log md5 of attachments
Feature #2409: Push signatures without reloading the entire set.
Feature #2410: Create a reset counter and track maximum number of parallel flows
Feature #2415: Force timestamp to UTC timezone via yaml
Feature #2416: Increase XFF coverage to files and http log
Feature #2417: Add Option to Delete Pcap Files After Processing
Feature #2421: Warn user if -r (pcap offline mode) is used with default log dir
Feature #2426: tls: extend logging
Feature #2448: Add additional buffers for DNS Responses
Feature #2450: lua scripts access to calling rule informations
Feature #2455: Add WinDivert source to Windows builds
Feature #2459: Support of FTP active mode
Feature #2467: 4.1beta1 - non rust builds with SMB enabled
Feature #2484: no stream events after known pkt loss in flow
Feature #2485: http: log byte range with file extraction
Feature #2486: prefilter/fast_pattern logic for flowbits
Feature #2487: Buffers for field/value pairs in http_uri and http_client_body
Feature #2488: HTML Parsing / Buffers
Feature #2497: error messages usability improvement