Project

General

Profile

Roadmap

5.0rc1

63%

63 issues   (40 closed — 23 open)

Related issues
Feature #524: detect double encoding in URI Actions
Feature #997: Add libhtp event for every htp_log() that needs an event. Actions
Feature #1125: smtp: improve protocol detection Actions
Feature #1203: TCP Fast Open support Actions
Feature #2283: turn content modifiers into 'sticky buffers' Actions
Feature #2315: eve: ftp logging Actions
Feature #2497: error messages usability improvement Actions
Feature #2539: protocol parser: vxlan Actions
Feature #2670: tls_cert sticky buffer Actions
Feature #2678: list-keywords: add info about fast_pattern and transforms Actions
Feature #2684: Add JA3S Actions
Feature #2738: SNMP parser, logging and detection Actions
Feature #2940: document anomaly log Actions
Feature #2941: anomaly log: add protocol detection events Actions
Feature #2952: modernize http_header_names Actions
Feature #3058: Hardware offload for XDP bypass Actions
Feature #3059: Use pinned maps in XDP bypass Actions
Feature #3060: Add way to detect TCP MSS values Actions
Feature #3061: Add way to inspect TCP header Actions
Feature #3062: Add way to inspect UDP header Actions
Feature #3074: DNS full domain matching within the dns_query buffer Actions
Feature #3080: Provide a IP pair XDP load balancing Actions
Feature #3081: Decapsulation of GRE in XDP filter Actions
Task #2839: Update perf and tuning user guides Actions

BuildBot

Place to collect tickets about BuildBot ideas, suggestions, etc.

44%

9 issues   (4 closed — 5 open)

Related issues
Feature #633: open buildbot instance to the public Actions
Feature #655: openbsd 5.2 buildslave Actions
Feature #657: buildbot build with --enable-debug-validation Actions
Feature #658: buildbot pcap run with --enable-debug-validation Actions
Feature #661: buildbot addition of missing OSs Actions
Feature #966: scan-build support in the buildbot Actions
Feature #974: valgrind leak check Actions
Feature #1010: dns fuzzer Actions
Feature #1011: integrate fuzzer into buildbot Actions

Documentation

Place to collect tickets about missing docs, doc errors

91%

43 issues   (39 closed — 4 open)

Related issues
Feature #589: ssl_state keyword not documented Actions
Feature #590: document pulledpork for rule updates Actions
Feature #631: add user/group info to yaml doc Actions
Feature #642: document pkt acquisition API Actions
Feature #643: unix socket: document protocol Actions
Feature #644: unix socket: document adding commands Actions
Feature #645: unix socket: user guide Actions
Feature #756: document http_host and http_raw_host Actions
Feature #1612: Sphinx for docs Actions
Feature #1613: document sphinx switch Actions
Feature #1620: User guide conversion to Sphinx: 8. Suricata Rules Actions
Feature #1621: Docs: Convert Section 6. Command Line Options Actions
Feature #1622: Docs: Convert Section 9. Rule Management with Oinkmaster Actions
Feature #1623: Docs: Convertion Section 10. Performance Actions
Feature #1624: Docs: Convert Section 11. Configuration Actions
Feature #1625: Docs: Convert Section 12. Reputation Actions
Feature #1626: Docs: Convert Section 13. Init Scripts Actions
Feature #1627: Docs: Convert Section 14: Setting up IPS/Inline for Linux Actions
Feature #1628: Docs: Convert Section 15. Output Actions
Feature #1629: Docs: Convert Section 16. File Extraction Actions
Feature #1630: Docs: Convert Section 18. Public Data Sets Actions
Feature #1631: Docs: Convert Section 20. Using Capture Hardware Actions
Feature #1658: Docs: Add Installation Guides to the Sphinx Documentation Actions
Feature #1685: Docs: To add the installation sheet for openSUSE distro Actions
Feature #1747: document rate_filter Actions
Task #2976: review userguide from beginners point of view Actions

Packaging/PPA

78%

27 issues   (21 closed — 6 open)

Related issues
Feature #695: Ubuntu PPA Doesn't Install Any Rules Actions
Feature #699: packaging for Mac Actions
Feature #734: Ubuntu PPA should be compiled with unix socket support enabled Actions
Feature #905: PPA packaging - log directories check Actions
Feature #949: SUSE automatic package building system Actions
Feature #1216: Debian repository Actions
Feature #1819: Silent installer for suricata windows Actions
Feature #1822: Support for hiredis in Ubuntu PPA Actions
Feature #2150: Support for attaching Suricata to multiple NFQ's using the default startup script Actions

QA

44%

16 issues   (7 closed — 9 open)

Related issues
Feature #1369: json schema Actions
Feature #1553: AppVeyor - TravisCI for Windows builds Actions
Feature #1963: travis-ci: OS X support Actions
Feature #3082: suricata-verify: option to test 'skipped' tests Actions
Task #844: Testing topera against suricata Actions
Task #2920: syzbot addition to QA Actions
Task #2924: suricata-verify: per check version conditions Actions
Task #3001: travis-ci: add check that catches unused functions Actions
Task #3043: tftp: add suricata-verify test Actions
Task #3055: Add tests for: #78 uricontent matching regression Actions
Task #3056: Add test for #109: Inconsistent time stamps in http log file Actions
Task #3057: Add tests for #130: Content + nocase issue Actions

Soon

Placeholder for tickets that we'll hopefully get into the next major release.

11%

51 issues   (4 closed — 47 open)

Related issues
Feature #425: Inspect the effects of mixing threshold and detection filters etc.. Actions
Feature #880: memcap http parser Actions
Feature #962: Can I log the mac address of the source? Actions
Feature #1025: seperate #ifdef UNITTEST code into their own files Actions
Feature #1348: OOBE -6- increasing max-pending-packets default value Actions
Feature #1469: Use ISO 8601 date/time formats Actions
Feature #1604: mixed IDS/IPS mode Actions
Feature #1807: Cisco HDLC Decoder Actions
Feature #2015: eve: add fileinfo in alert Actions
Feature #2291: traffic-id: ruleset for traffic classification and bypass Actions
Feature #2727: DCERPC UID to name mapping Actions
Task #3092: Date of revision should also be a part of info from suricata -v Actions

Suricata-Update - Soon

12%

26 issues   (3 closed — 23 open)

Related issues
Suricata-Update - Feature #2256: Generate a report and log it to a file. Actions
Suricata-Update - Feature #2341: check versions of suricata and suricata-update Actions
Suricata-Update - Feature #2472: update-sources should give a summary of changes Actions
Suricata-Update - Feature #2509: Add support to have more than one condition to match a rule Actions
Suricata-Update - Feature #2565: Regular and verbose status output should go to STDOUT, not STDERR Actions
Suricata-Update - Feature #2659: Define the output rules file name. Actions
Suricata-Update - Feature #2864: Suricata-update merging local rules without trying to fetch rules from sources outside (offline mode) Actions
Suricata-Update - Feature #2906: Make sure that noalert is set in newly enabled rules Actions
Suricata-Update - Feature #2938: Add a "show-defaults" command Actions
Suricata-Update - Task #3038: documentation: Setup directories with correct permissions Actions

TBD

To be determined -- place holder for tickets that are not prioritized/scheduled yet

6%

477 issues   (30 closed — 447 open)

Related issues
Feature #120: Capture full session on alert Actions
Feature #121: Alert on domain name look up, capture traffic for corresponding IP Actions
Feature #249: Configure host-os-policy from a file, like snorts host_attribute.xml Actions
Feature #266: log http raw request for network forensic Actions
Feature #273: IRC protocol detection support Actions
Feature #276: Libcap support for dropping privileges Actions
Feature #294: Limit inspection of a stream and/or rule... Actions
Feature #328: Traceability and QA with regards to rules loaded Actions
Feature #352: Switching to message queuing system for output Actions
Feature #365: expose interface(unix socket command) to reset tcp connection Actions
Feature #385: Configuration option to log all known (pcap) data for a stream when an alert fires Actions
Feature #432: PCAP-NG support Actions
Feature #448: dlp: md5sum based on part of files Actions
Feature #465: benchmark runmode Actions
Feature #473: pcap log: alert log with packet indexes Actions
Feature #511: Port indepedent protocol identification Actions
Feature #535: new keywords - time , day Actions
Feature #544: Live traffic decryption Actions
Feature #547: libinjection -- sqli library Actions
Feature #548: Use bloomfilter for filemd5 Actions
Feature #584: lua: expose file buffers Actions
Feature #596: rule profiling: multiple outputs per run Actions
Feature #609: Active Response in inline mode (like react in snort 2.9+) Actions
Feature #614: Rate limiting messages Actions
Feature #641: Flowbits group for ORing Actions
Feature #659: Update IP reputation from unix socket. Actions
Feature #660: Update host policy from unix socket Actions
Feature #682: Add DEP and ASLR to Windows Binary Actions
Feature #713: tls.fingerprint - file usage Actions
Feature #716: configurable packet_stats.csv and packet_stats.log Actions
Feature #721: full nfq zero copy mode Actions
Feature #728: Add support for OpenCL Actions
Feature #745: Tunnel configuration Actions
Feature #776: Add smtp_envelope and smtp_header keywords Actions
Feature #783: LuaJIT be able to return various messages for a single script. Actions
Feature #808: Support the new GSO-avoidance NFQ feature Actions
Feature #816: TCP SACK: limits per stream Actions
Feature #821: Conditional logging Actions
Feature #843: Custom http logging filter functionality Actions
Feature #845: Memory consumption in stats.log Actions
Feature #870: luajit: global vars Actions
Feature #902: VLAN host table support Actions
Feature #933: add a IPv6 ( RFC2460 recommended order of EH )rule to decoder events rules Actions
Feature #936: support tzsp protocol Actions
Feature #947: dynamic allocation of thread queues Actions
Feature #960: persistent TCP resets Actions
Feature #1002: Possible to disabling/bypassing a rule by a specific source ip and a destination ip? Actions
Feature #1005: conditional logging Actions
Feature #1015: add chained content info to rule analysis Actions
Feature #1017: Add support for content-range Actions
Feature #1065: Introduce vlan id keyword Actions
Feature #1095: Integration of support for STIX-based indicators Actions
Feature #1096: Log TLS client certificate Actions
Feature #1132: set rpath for libs not in the default linker paths Actions
Feature #1140: IP-Address white list implementation for IPS mode (without disable a rule global) Actions
Feature #1191: EVE log does not support customformat Actions
Feature #1194: Implement http_args keyword to match http arguments - query string or body Actions
Feature #1199: LDAP support Actions
Feature #1215: journald logging support Actions
Feature #1229: Suricata alerts in CEF Format Actions
Feature #1233: Documentation for each keyword in stats.log file. Actions
Feature #1234: nfqueue: use mnl API Actions
Feature #1239: Best effort TCP stack Actions
Feature #1245: Add "drop-only" and "alert-only" option for pcap-log Actions
Feature #1249: http/dns ip-reputation alike technique Actions
Feature #1250: Multipath TCP Actions
Feature #1274: ssh events Actions
Feature #1283: support for snort's file_data keyword Actions
Feature #1290: handle SIGHUP signal Actions
Feature #1300: profiling: per flow recording of profiling data Actions
Feature #1323: automated eve.json rotation Actions
Feature #1380: JSON and Unified2 output "payload" does not contain full (or real in the case of Unified2) packets for session Actions
Feature #1389: suppress by host Actions
Feature #1478: Active flow counters Actions
Feature #1489: Log a message when memcap limit is reached Actions
Feature #1504: better notification in verbose mode on luascript err Actions
Feature #1505: Show loaded lua scripts during live rule swap or normal start in verbose mode Actions
Feature #1520: multitenancy - verbose output clarity Actions
Feature #1541: multi-detect - vlan range mapping Actions
Feature #1542: dump-config - extend into multi-detect supplied yaml configuration Actions
Feature #1545: Add type variable into StatsRecord Actions
Feature #1566: ICMPv4 control channel detection Actions
Feature #1571: Socket permissions setting in suricata.yaml Actions
Feature #1576: http: byte-range support Actions
Feature #1590: lua: force file magic and md5 lookup from script Actions
Feature #1608: Add option to disable JSON escape slash Actions
Feature #1662: Disable action / rule ordering option Actions
Feature #1691: Docs: Convert windows docs Actions
Feature #1710: Unix socket: Send output to unix socket Actions
Feature #1712: multitenancy: 'lite' tenants Actions
Feature #1726: pfring: IPS support Actions
Feature #1741: flow: use capture methods flow hash Actions
Feature #1750: Set Suricata to listen to all network interfaces when using AF_PACKET Actions
Feature #1752: Netmap for Windows Actions
Feature #1757: URL Reputation Actions
Feature #1766: TLS keyword expansion Actions
Feature #1767: Support DTLS protocol Actions
Feature #1783: Create Suricata buffers to expose L2, L3, and L4 headers to Lua scripts Actions
Feature #1794: test suricata rules over unix-socket Actions
Feature #1799: netmap: capture drop stats Actions
Feature #1828: YARA support Actions
Feature #1851: add verbosity level description to the help command Actions
Feature #1872: add --list-decoder-protos or similar Actions
Feature #1892: rule docs should include example rules Actions
Feature #1899: Detecting Malicious TCP Network Flows Based on Benford’s Law Actions
Feature #1939: Introduce packet/byte counter in stats.log/json for local bypass Actions
Feature #1940: Debian Jessie - better message when trying to run 2 suricata with afpacket Actions
Feature #1947: HTTP2 decoder Actions
Feature #1950: allow configuration of file-store types Actions
Feature #1954: runtime option/flag to disable hardware timestamp support Actions
Feature #1956: Add option to re-initialise Lua output scripts Actions
Feature #1971: lua: make mandatory Actions
Feature #1974: DNP3: document lua support Actions
Feature #1977: get the os info from TCP HTTP fingerprint Actions
Feature #1979: TCP/IP packets normalization/scrubbing Actions
Feature #1993: commandline: introduce --enable-all-outputs switch Actions
Feature #1995: fast.log should show if packet has been dropped or rejected Actions
Feature #2016: doc: improve keywords self documentation Actions
Feature #2021: doc: sha256 filesum extraction missing in documentation Actions
Feature #2054: Extracting HTTPS URL´s from SMTP, currently only HTTP is supported Actions
Feature #2055: Optionally logging on files.json - Not log every file, only certain files that are stored and extracted Actions
Feature #2092: Improved support for xbits/hostbits - workers runmode Actions
Feature #2096: eve: event_type for MODBUS Actions
Feature #2107: eve: rotate log output based on size Actions
Feature #2115: Changing interfaces Actions
Feature #2127: Rate Limiting by Tracking Both Source & Destination IP Addresses Actions
Feature #2145: Relate directly flowid with certificate file Actions
Feature #2166: output: log only triggering buffers Actions
Feature #2167: eve-ng Actions
Feature #2168: Rules files from Suricata sources (like decoder-events.rules) are packaged as config files and may not be updated on package update. Actions
Feature #2174: Need a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET Actions
Feature #2196: Add flow_id to the file extracted .meta file Actions
Feature #2198: Extend the DNS parser to accept dns_response keyword in signatures Actions
Feature #2200: Dynamically add md5 to blacklist without full restart Actions
Feature #2211: doc: document issues with --set and lists in the command line parameters section of the manual Actions
Feature #2213: file matching: allow generic file matching / store Actions
Feature #2219: Save pcap only if alert Actions
Feature #2227: more detailed output about number of threads created Actions
Feature #2232: Allow Large value in suricata.yaml file Actions
Feature #2233: Allow log for payload and packet only for defined sid Actions
Feature #2262: Unix Socket Output Configurable Retries and Blocking Actions
Feature #2269: TLS: tls.version: allow negation or comparison Actions
Feature #2273: engine analysis: enable analysis by default during startup Actions
Feature #2277: netinfo: structured information about the network. Output hierarchical network tree in events Actions
Feature #2278: failing better Actions
Feature #2280: http: rules that match both request and response Actions
Feature #2281: tcp stream: simpler IDS handling of overlap evasions Actions
Feature #2284: detect partial file transfers Actions
Feature #2286: doc: document best practices around handling file extraction Actions
Feature #2290: lua: expose lua generated buffers to rule lang Actions
Feature #2300: DPDK integration Actions
Feature #2301: netflow: dump records at interval Actions
Feature #2308: threshold/suppress by http_host Actions
Feature #2310: lua: expose xbits Actions
Feature #2311: math on extracted values Actions
Feature #2312: http: parsing for async streams Actions
Feature #2313: save & restore state when suricata restarts Actions
Feature #2314: protocol parser: rdp Actions
Feature #2316: global memcap Actions
Feature #2318: matching on large amounts of data with dynamic updates Actions
Feature #2319: Expose flow lifetime to the rulelanguage Actions
Feature #2323: Applayer support for telnet Actions
Feature #2342: Write PCAP files directly to Unix Socket Actions
Feature #2343: Add "flush" command to unix socket Actions
Feature #2363: pcap: read directories recursively Actions
Feature #2371: list all available /exposed fields to lua Actions
Feature #2375: Design and implement sensible per-thread capabilities Actions
Feature #2377: deprecate: ssh.softwareversion and ssh.protoversion Actions
Feature #2380: [discussion] deprecate: 'alert syslog' output Actions
Feature #2385: deprecate: unified2 Actions
Feature #2388: smtp: log md5 of attachments Actions
Feature #2409: Push signatures without reloading the entire set. Actions
Feature #2410: Create a reset counter and track maximum number of parallel flows Actions
Feature #2426: tls: extend logging Actions
Feature #2448: Add additional buffers for DNS Responses Actions
Feature #2450: lua scripts access to calling rule informations Actions
Feature #2486: prefilter/fast_pattern logic for flowbits Actions
Feature #2487: Buffers for field/value pairs in http_uri and http_client_body Actions
Feature #2488: HTML Parsing / Buffers Actions
Feature #2513: Suricata read the SSLProxy header Actions
Feature #2519: XFF iprep support Actions
Feature #2524: Allow user to choose the reject iface Actions
Feature #2529: doc: include quick start guide Actions
Feature #2538: dsize keyword improvements Actions
Feature #2553: support 'by_both' in threshold rule keyword Actions
Feature #2569: multi-tenancy: allow mapping to 'device pair' in IPS mode Actions
Feature #2613: stats: add xdp counters to stats Actions
Feature #2628: Specify the flow direction in metadata sent by Suricata. Actions
Feature #2629: Rust2018 Tracking Actions
Feature #2644: Add direction of stream to eve-json events Actions
Feature #2648: store captured data into file Actions
Feature #2661: output the http-body-data to eve.json Actions
Feature #2672: Split out DHCP parser to be reusable Actions
Feature #2673: Split out DNS parser to be reusable Actions
Feature #2674: Split out NFS parser to be reusable Actions
Feature #2675: Split out SMB parser to be reusable Actions
Feature #2681: Reloading of categories file, IP reputation list during rule live reload Actions
Feature #2689: Normalized HTTP client body buffer Actions
Feature #2693: libsuricata Actions
Feature #2694: thresholding: feature parity between global and per-rule options Actions
Feature #2695: websocket support Actions
Feature #2696: http parser in rust Actions
Feature #2697: prefilter support for stream_size Actions
Feature #2698: hassh and hasshServer for ssh fingerprinting Actions
Feature #2699: document all eve record types and fields Actions
Feature #2700: ja3/ja3s functionality for IKEv2 Actions
Feature #2701: flow: counter for allocations at runtime Actions
Feature #2713: protocol detection w/o protocol parsing Actions
Feature #2746: Use Available Instruction Set Specialization (AVX2 and AVX512) in Hyperscan when available Actions
Feature #2754: JA3 and JA3S - sets / reputation Actions
Feature #2755: vendor id / vid keyword to give rulesets unique sid ranges Actions
Feature #2756: rules input in json format Actions
Feature #2757: improve protocol detection Actions
Feature #2758: intel / reputation matching on arbitrary data Actions
Feature #2759: iprep: more granularity Actions
Feature #2767: Interception of network stack attacks Actions
Feature #2771: MPLS over Vlan support Actions
Feature #2772: Add MPLS labels to alert output Actions
Feature #2789: Use clang for building eBPF programs even if Suricata is built using GCC Actions
Feature #2816: vlan: support more than 2 layers Actions
Feature #2818: Napatech Bypass support Actions
Feature #2859: Oss-fuzz integration Actions
Feature #2860: Suricata doesn't detect part of IKEv2 traffic Actions
Feature #2871: Exposing byte extract to Lua Actions
Feature #2876: doc: add nftables with nfqueue section Actions
Feature #2916: FTP decoder should have Rust port parsers Actions
Feature #2923: suricata-verify: eve2test util Actions
Feature #2925: Support for SPB encapsulation Actions
Feature #2931: Perform privdrop without libcap-ng support Actions
Feature #2935: Support for multiple-logger for drop eve-log Actions
Feature #2939: Suricata enhancements - proposals Actions
Feature #2957: Suricata x Moloch - protocol detection. Proposals for TLS/SSL Actions
Feature #2958: Suricata 5.0.0beta1 and way too much anomaly logging Actions
Feature #2962: Suricata x Moloch - protocol detection. Proposals for IKEv2 Actions
Feature #2970: DNS: Parse and extract SOA app layer data from DNS packets Actions
Feature #2987: Suggestions for new keywords (streambits) Actions
Feature #2996: Extend decode events and rules Actions
Feature #3003: filestore to uses rename syscall instead of sendfile,which doesn't allow files to be sent across file systems Actions
Feature #3011: Add new 'cluster_peer' runmode to allow for load balancing by IP header (src<->dst) only Actions
Feature #3042: stats: allow per second stats updates Actions
Feature #3063: protocol decoder: geneve Actions
Feature #3084: SIP parser, logging and detection Actions
Feature #3086: app_proto for Torrent traffic? Actions
Task #2381: deprecate: 'drop' log output Actions
Task #2778: Protocol Parsing Rust Conversion Tracking Actions
Task #2959: deprecate: filestore v1 Actions
Task #2974: detect: check all keyword urls Actions
Task #2975: convert unittests to new FAIL/PASS API Actions
Task #3014: Missing documentation for "flags" option Actions
Task #3015: Missing documentation for "tag" keyword Actions
Task #3016: No documentation for "endswith" keyword Actions
Task #3017: No documentation for "rawbytes" keyword Actions
Task #3018: No documentation for "flowvar" keyword Actions
Task #3019: No documentation for "pktvar" keyword Actions
Task #3022: No documentation for "nfq_set_mark" keyword Actions
Task #3023: No documentation for "bsize" keyword Actions
Task #3025: Missing docs for "http." keywords Actions
Task #3027: No documentation for "nfs" keywords Actions
Task #3028: No documentation for "pkt_data" keyword Actions
Task #3029: No documentation for "dcerpc" keywords Actions
Task #3030: No documentation for "smb" keywords Actions
Task #3031: No documentation for "asn1" keyword Actions
Task #3032: No documentation for "engine-event" keyword Actions
Task #3033: No documentation for "stream-event" keyword Actions
Task #3034: No documentation for "l3_proto" keyword Actions
Task #3035: No docs for "base64_" keywords Actions
Task #3036: No documentation for "template2" keyword Actions