Project

General

Profile

Roadmap

6.0.7

open

Due in 3 days (09/27/2022)

70%

17 issues   (12 closed — 5 open)

Related issues
Feature #5500: ips: midstream: add "exception policy" for midstream (6.0.x backport) Actions
Feature #5535: ips: add "reject" action to exception policies (6.0.x backport) Actions
Task #5328: python: distutils deprecation warning (6.0.x backport) Actions
Task #5381: add `alert-queue-expand-fails` command-line option (6.0.x backport) Actions
Task #5525: exceptions: error out when invalid configuration value is passed (6.0.x backport) Actions
Task #5533: detect/parse: add tests for parsing signatures with reject and drop action (6.0.x backport) Actions
Task #5551: doc: add exception policy documentation (6.0.x) Actions
Task #5552: libhtp 0.5.41 Actions

7.0rc1

open

Due in 24 days (10/18/2022)

73%

504 issues   (365 closed — 139 open)

Related issues
Feature #120: Capture full session on alert Actions
Feature #1005: conditional logging: controlling what gets logged Actions
Feature #1096: tls: client certificate handling Actions
Feature #1125: smtp: improve protocol detection Actions
Feature #1369: eve: json schema Actions
Feature #1478: Active flow counters Actions
Feature #1542: dump-config - extend into multi-detect supplied yaml configuration Actions
Feature #1576: http: byte-range support Actions
Feature #2054: Extracting HTTPS URL´s from SMTP, currently only HTTP is supported Actions
Feature #2096: eve: event_type for MODBUS Actions
Feature #2269: TLS: tls.version: allow negation or comparison Actions
Feature #2323: Applayer support for telnet Actions
Feature #2450: lua: scripts access to calling rule informations Actions
Feature #2486: prefilter/fast_pattern logic for flowbits Actions
Feature #2497: error messages usability improvement Actions
Feature #2697: prefilter support for stream_size Actions
Feature #2816: vlan: support more than 2 layers Actions
Feature #3002: Flow and Netflow Not Logging ESP Traffic Actions
Feature #3086: app_proto for Torrent traffic Actions
Feature #3285: rules: XOR keyword Actions
Feature #3292: support for network service header (NSH) Actions
Feature #3440: Add GQUIC Protocol Analysis and CYU Fingerprinting Actions
Feature #3512: stream depth event rule Actions
Feature #3701: eve: add tenant_id in eve-log for other types than alert Actions
Feature #3767: Add IKEv1 parser Actions
Feature #3887: yaml: Increase maximum size for address vars Actions
Feature #3957: Convert protocol to Rust: Modbus Actions
Feature #4116: http2: body compression handling Actions
Feature #4117: http2: byte-range support Actions
Feature #4118: http2: byte-range support for ip-pair Actions
Feature #4136: use Suricata-Update managed classification.config Actions
Feature #4142: file.data: support for NFS Actions
Feature #4144: file.data: support for request side files in HTTP Actions
Feature #4174: tracking: app-layer frame inspection support Actions
Feature #4226: bsize: apply as depth to patterns Actions
Feature #4241: Protocol support: PostgreSQL (pgsql) Actions
Feature #4269: Additional dataset operations Actions
Feature #4325: xdp compile warnings on 5.4 kernels Actions
Feature #4332: Makes libhtp decompression time limit configurable from Suricata Actions
Feature #4386: Support for RFC2231 Actions
Feature #4406: unix socket: Get flow information by flow_id Actions
Feature #4498: decoder: add VN-Tag support Actions
Feature #4507: dpdk: initial support for IDS and IPS modes Actions
Feature #4515: Add DNS logging of Z flag Actions
Feature #4526: SIGSEGV handling -- log stack before aborting Actions
Feature #4541: netmap: new API version (14) supports multi-ring software mode Actions
Feature #4550: pthreads: set minimum stack size Actions
Feature #4551: eve: add direct base64 to json option to json builder Actions
Feature #4556: HTTP2: support deflate decompression Actions
Feature #4566: pgsql: add subprotocol-states Actions
Feature #4756: capture: support ips stats for all IPS capture methods Actions
Feature #4854: pgsql: Add COPY subprotocol-state Actions
Feature #4861: smb: support multi-stream file transfers Actions
Feature #4872: nfs: add stream app-layer frame support Actions
Feature #4876: Additional FTP Buffers Actions
Feature #4905: smtp: add stream app-layer frame support Actions
Feature #4906: ftp: add stream app-layer frame support Actions
Feature #4967: QUIC v1 support Actions
Feature #4980: doc/frames: document frame rule keyword Actions
Feature #4983: frames: support UDP Actions
Feature #4984: dns: add frames support Actions
Feature #5036: sip: add frames support Actions
Feature #5049: detect/frames: allow mixing with txs Actions
Feature #5082: smb: keyword for matching the SMB files Actions
Feature #5190: new tls.random keyword Actions
Feature #5191: new keyword for self signed certificates Actions
Feature #5194: tracking: options for simulating various exceptions Actions
Feature #5202: eve/drop: include drop "reason" Actions
Feature #5214: ips: allow dropping of flow if stream.memcap is hit Actions
Feature #5215: ips: allow dropping of flow if stream.reassembly.memcap is hit Actions
Feature #5216: ips: allow dropping of flow if flow.memcap is hit Actions
Feature #5218: ips: allow dropping of flow if applayer reaches error state Actions
Feature #5224: How to extact http from https while upload ca and cert of tls Actions
Feature #5286: ips: allow dropping of packet/flow when alert queue exceeded Actions
Feature #5416: SNMP: signature keyword for usm Actions
Feature #5435: DHCP: signature keyword for lease_time Actions
Feature #5442: kerberos: log ticket encryption method Actions
Feature #5468: ips: midstream: add "exception policy" for midstream Actions
Feature #5503: ips: add "reject" action to exception policies Actions
Feature #5506: DHCP: signature keyword for rebinding_time Actions
Feature #5509: App-layer event for protocol change failure Actions
Task #2693: tracking: libsuricata Actions
Task #3194: pcre2 support Actions
Task #3343: tracking: developer documentation Actions
Task #3862: qa: CI improvements Actions
Task #3905: GitHub CI: use sccache for commits build Actions
Task #4053: Convert unittests to new FAIL/PASS API: detect-msg.c Actions
Task #4056: Convert unittests to new FAIL/PASS API: detect-rpc.c Actions
Task #4058: Convert unittests to new FAIL/PASS API: detect-sid.c Actions
Task #4103: Plugins: Convert a "core" parser (DNS) to use the plugin API Actions
Task #4105: Plugins: Create template capture source plugin Actions
Task #4122: tracking: handle various TLS decrypt headers in proxies and decryption tools Actions
Task #4143: tracking: file.data improvements Actions
Task #4157: deprecation: remove dns eve v1 logging (May 2022) Actions
Task #4163: rust: set new minimum Rust version for 7 Actions
Task #4176: plugins: review capture plugin API Actions
Task #4182: lua: Use lua_pushinteger for pushing integer types as integers instead of floats Actions
Task #4201: http2: full protocol support Actions
Task #4221: Build Suricata into a static and shared library Actions
Task #4429: libsuricata: Use cases with examples Actions
Task #4444: tracking: store files in transactions instead of per flow state Actions
Task #4446: pcre2: document changes vs prce1 for rule writers Actions
Task #4480: Packaging/RPM: Remove engine provided rules from /etc/suricata/rules Actions
Task #4667: libhtp 0.5.39 Actions
Task #4668: Remove Prelude output Actions
Task #4698: Example program to bootstrap Suricata (an alternate main() for Suricata) Actions
Task #4721: http2: enable by default Actions
Task #4742: Make the auto-generated config.h not conflict with other config.h. Actions
Task #4784: config: add suricata version as a comment to the top of the configuration file Actions
Task #4796: af-packet: remove non-mmap tpacket-v1 support Actions
Task #4909: devguide: move into userguide as last chapter Actions
Task #4912: Update default rule path to /var/lib/suricata/rules. Actions
Task #4919: Add option to change sensor-name log field Actions
Task #4939: app-layer: template and setup script Actions
Task #4964: config: test with older configs Actions
Task #4970: libhtp 0.5.40 Actions
Task #4992: dcerpc: convert parser to nom7 functions Actions
Task #4993: asn1: convert parser to nom7 functions Actions
Task #4994: ike: convert parser to nom7 functions Actions
Task #4995: snmp: convert parser to nom7 functions Actions
Task #4996: rdp: convert parser to nom7 functions Actions
Task #4997: mime: convert parser to nom7 functions Actions
Task #4998: krb: convert parser to nom7 functions Actions
Task #4999: ntp: convert parser to nom7 functions Actions
Task #5000: rfb: convert parser to nom7 functions Actions
Task #5001: x509: convert parser to nom7 functions Actions
Task #5002: applayertemplate: convert parser to nom7 functions Actions
Task #5050: rules/frames: settle on rule syntax Actions
Task #5143: QUIC: support JA3 Actions
Task #5166: quic: Support older versions like Q039 and Q043 Actions
Task #5175: nfs4: Improve compound record parsers Actions
Task #5179: stats/alert: log out to stats alerts that have been discarded from packet queue Actions
Task #5180: detect/alert: make sure that signatures with `drop` action are respected, even if the alert is discarded Actions
Task #5319: add `alert-queue-expand-fails` command-line option Actions
Task #5465: doc/userguide: document terminating behavior of rule actions Actions
Task #5472: tracking: upgrading from 6 to 7 Actions
Task #5473: doc: upgrade guide for upgrading from 6 to 7 Actions
Task #5474: test: review how 7 works with config from 5 and 6 Actions
Task #5475: doc: add exception policy documentation Actions
Task #5497: github-ci: update runners using ubuntu-18.04 image Actions
Documentation #3017: No documentation for "rawbytes" keyword Actions
Documentation #3029: No documentation for "dcerpc" keywords Actions
Documentation #4396: Devguide: Transactions and State overview Actions
Documentation #4557: Add document about JsonBuilder Actions
Documentation #4671: Document changes to HTTP events with respect to http/http2 normalization Actions
Documentation #4705: userguide: add sections about frame support Actions
Documentation #4949: userguide: add explanation on max-streams in the suricata.yaml page Actions
Documentation #5008: userguide: add a protocol chart listing defaults Actions
Documentation #5078: suricata config reload: improve documentation on behavior Actions
Documentation #5130: doc: add flowbits ORing doc Actions
Documentation #5138: userguide: add a section for fileinfo eve type Actions
Documentation #5139: userguide: add a section for netflow event type Actions
Documentation #5364: userguide: reorganize `Application Layers Parsers` and `Application layers` subsections in the suricata.yaml page Actions
Documentation #5385: userguide: update rule's format document Actions
Documentation #5441: userguide: rules meta page updates Actions
Documentation #5511: userguide: add subsection about setting up Suri in IPS mode with DPDK Actions
Documentation #5554: userguide: document Suri's behavior for actions like PASS, DROP, REJECT, BYPASS... Actions

7.0.0

open

Due in about 2 months (12/06/2022)

No issues for this version

Suricata-Update - 1.3.0

open

36%

11 issues   (4 closed — 7 open)

Related issues
Suricata-Update - Feature #2256: Generate a report and log it to a file. Actions
Suricata-Update - Feature #2938: Add a "show-defaults" command Actions
Suricata-Update - Feature #4362: HTTP BasicAuth Support Actions
Suricata-Update - Feature #4479: Work on FIPS compliant CentOS releases. Actions
Suricata-Update - Feature #4481: list-sources: list locally added sources, and make it clear they are local sources Actions

5.0.11

locked

Unrelease as 5.0.x went EOL on Aug 1, 2022.

No issues for this version

8.0beta1

open

2%

40 issues   (1 closed — 39 open)

Related issues
Feature #1199: LDAP support Actions
Feature #1993: commandline: introduce --enable-all-outputs switch Actions
Feature #2290: lua: use script as transform Actions
Feature #2375: Design and implement sensible per-thread capabilities Actions
Feature #2377: deprecate: ssh.softwareversion and ssh.protoversion Actions
Feature #2448: Add additional buffers for DNS Responses Actions
Feature #2678: list-keywords: add info about fast_pattern and transforms Actions
Feature #2696: http parser in rust Actions
Feature #2958: Suricata 5.0.0beta1 and way too much anomaly logging Actions
Feature #3003: filestore to uses rename syscall instead of sendfile,which doesn't allow files to be sent across file systems Actions
Feature #3487: multi-part parser in Rust Actions
Feature #3636: eve: configuration options to enable all, none or just a default set of outputs Actions
Feature #3912: yaml: --include <yaml> commandline option Actions
Feature #4089: rules: Flexible format transform Actions
Feature #4099: allow rule keyword registration from app-layer Actions
Feature #4153: Rust parsers: Make use of Rust derive style macros to generate common code in parsers Actions
Feature #4855: rules: refactor rule parsing into multi-stage parser Actions
Feature #4904: dcerpc: add stream app-layer records support Actions
Feature #4910: dpdk: implement secondary mode Actions
Feature #4986: postgresql: support frames Actions
Feature #5203: dpdk: implement primary app for Suricata secondary mode Actions
Feature #5234: SSL/TLS Sticky Buffer for subjectAltName Actions
Task #3166: src code file reorg Actions
Task #3334: Cleanup registration of C function pointers in SuricataContext in main() Actions
Task #3695: research: libhwloc for better autoconfiguration Actions
Task #4098: Convert SMTP to Rust Actions
Task #4704: unix-socket: separate functionality from the unix socket interface Actions
Task #4936: Use Rust to parse unix socket messages Actions
Task #5053: app-layer: dynamic alproto IDs Actions

BuildBot

open

Place to collect tickets about BuildBot ideas, suggestions, etc.

100%

7 issues   (7 closed — 0 open)

Related issues
Feature #633: open buildbot instance to the public Actions
Feature #655: openbsd 5.2 buildslave Actions
Feature #657: buildbot build with --enable-debug-validation Actions
Feature #658: buildbot pcap run with --enable-debug-validation Actions
Feature #661: buildbot addition of missing OSs Actions
Feature #974: valgrind leak check Actions
Feature #1011: integrate fuzzer into buildbot Actions

Packaging/PPA

open

75%

29 issues   (22 closed — 7 open)

Related issues
Feature #695: Ubuntu PPA Doesn't Install Any Rules Actions
Feature #699: packaging for Mac Actions
Feature #734: Ubuntu PPA should be compiled with unix socket support enabled Actions
Feature #905: PPA packaging - log directories check Actions
Feature #949: SUSE automatic package building system Actions
Feature #1216: Debian repository Actions
Feature #1819: Silent installer for suricata windows Actions
Feature #1822: Support for hiredis in Ubuntu PPA Actions
Feature #2150: Support for attaching Suricata to multiple NFQ's using the default startup script Actions

QA

open

59%

66 issues   (39 closed — 27 open)

Related issues
Feature #966: scan-build support in the buildbot Actions
Feature #1553: AppVeyor - TravisCI for Windows builds Actions
Feature #1963: travis-ci: OS X support Actions
Feature #2923: suricata-verify: eve2test util Actions
Feature #3082: suricata-verify: option to test 'skipped' tests Actions
Feature #3357: suricata-verify: parallel tests capability Actions
Feature #3464: suricata-verify: Add unix-socket support Actions
Feature #3975: Suricata-Verify: Add JSON schema validation to EVE output. Actions
Feature #4059: createst: Commandline param to specify Suricata version Actions
Feature #4060: createst: Commandline param to specify minimum required version of Suricata Actions
Feature #4061: createst: Commandline param to specify required features Actions
Feature #4062: createst: Allow to exclude certain fields Actions
Feature #4185: "requires" should be allowed to be defined per check and not just globally Actions
Feature #4203: createst: ability to create diff between a PR and master Actions
Feature #4268: createst: allow to add options with --set Actions
Feature #5262: run.py: should tell which fields are mismatching Actions
Task #844: Testing topera against suricata Actions
Task #2920: syzbot addition to QA Actions
Task #2924: suricata-verify: per check version conditions Actions
Task #3001: github-ci: add check that catches unused functions Actions
Task #3043: tftp: add suricata-verify test Actions
Task #3055: Add tests for: #78 uricontent matching regression Actions
Task #3056: Add test for #109: Inconsistent time stamps in http log file Actions
Task #3057: Add tests for #130: Content + nocase issue Actions
Task #3144: Add dir as a visual indicator in the output Actions
Task #3269: Script for creating test with params Actions
Task #3869: GitHub CI: Migrate Travis tests that don't have a GitHub CI equivalent to GitHub CI Actions
Task #3961: ci: Tool/integration of tool for testing the coverage of code Actions
Task #3962: ci: Code coverage with unit tests Actions
Task #4278: ci: coverage support for rust Actions
Task #4761: ci: fix SV pcapng check Actions
Task #4814: GitHub: Add Fedora 35 builder to GitHub CI Actions
Task #4938: detect-file-data: cleanup smtp tests Actions
Task #4942: alerts: SV test for noalert issue Actions
Task #5122: alerts: SV test for noalert issue Actions
Task #5126: alerts: SV test for noalert issue Actions
Task #5318: tests: craft an SV for rate_filter Actions
Task #5371: util/action: convert unittests to suricata-verify tests Actions
Task #5482: create SV tests to demonstrate false positive behavior for negated content and distance (bug 3780) Actions
Task #5483: create SV tests to demonstrate false negative behavior for negated isdataat with http_cookie keyword (bug 4286) Actions

Suricata-Update - Soon

open

42%

14 issues   (6 closed — 8 open)

Related issues
Suricata-Update - Feature #2509: Add support to have more than one condition to match a rule Actions
Suricata-Update - Feature #2659: Define the output rules file name. Actions
Suricata-Update - Feature #3202: classtypes: validate classtypes in use Actions
Suricata-Update - Feature #3721: Add iprep compatibility Actions
Suricata-Update - Feature #4355: Easy way to disable all engine provided rules. Actions
Suricata-Update - Feature #5372: Add support for encrypted traffic analysis Actions
Suricata-Update - Documentation #3038: documentation: Setup directories with correct permissions Actions

TBD

open

To be determined -- place holder for tickets that are not prioritized/scheduled yet

14%

639 issues   (94 closed — 545 open)

Related issues
Feature #121: Alert on domain name look up, capture traffic for corresponding IP Actions
Feature #249: Configure host-os-policy from a file, like snorts host_attribute.xml Actions
Feature #266: log http raw request for network forensic Actions
Feature #273: IRC protocol detection support Actions
Feature #276: Libcap support for dropping privileges Actions
Feature #294: Limit inspection of a stream and/or rule... Actions
Feature #328: Traceability and QA with regards to rules loaded Actions
Feature #365: expose interface(unix socket command) to reset tcp connection Actions
Feature #385: Configuration option to log all known (pcap) data for a stream when an alert fires Actions
Feature #425: Inspect the effects of mixing threshold and detection filters etc.. Actions
Feature #432: PCAP-NG support Actions
Feature #448: dlp: md5sum based on part of files Actions
Feature #465: benchmark runmode Actions
Feature #473: pcap log: alert log with packet indexes Actions
Feature #511: Port indepedent protocol identification Actions
Feature #535: new keywords - time , day Actions
Feature #544: Live traffic decryption Actions
Feature #547: libinjection -- sqli library Actions
Feature #548: Use bloomfilter for filemd5 Actions
Feature #584: lua: expose file buffers Actions
Feature #596: rule profiling: multiple outputs per run Actions
Feature #609: Active Response in inline mode (like react in snort 2.9+) Actions
Feature #614: Rate limiting messages Actions
Feature #659: Update IP reputation from unix socket. Actions
Feature #682: Add DEP and ASLR to Windows Binary Actions
Feature #716: configurable packet_stats.csv and packet_stats.log Actions
Feature #721: full nfq zero copy mode Actions
Feature #728: Add support for OpenCL Actions
Feature #745: Tunnel configuration Actions
Feature #776: rules: Add smtp_envelope and smtp_header keywords Actions
Feature #783: LuaJIT be able to return various messages for a single script. Actions
Feature #808: Support the new GSO-avoidance NFQ feature Actions
Feature #816: TCP SACK: limits per stream Actions
Feature #821: conditional logging: output steering Actions
Feature #843: Custom http logging filter functionality Actions
Feature #845: Memory consumption in stats.log Actions
Feature #870: luajit: global vars Actions
Feature #880: memcap http parser Actions
Feature #902: VLAN host table support Actions
Feature #933: add a IPv6 ( RFC2460 recommended order of EH )rule to decoder events rules Actions
Feature #936: support tzsp protocol Actions
Feature #960: persistent TCP resets Actions
Feature #1002: Possible to disabling/bypassing a rule by a specific source ip and a destination ip? Actions
Feature #1015: add chained content info to rule analysis Actions
Feature #1025: seperate #ifdef UNITTEST code into their own files Actions
Feature #1065: Introduce vlan id keyword Actions
Feature #1095: Integration of support for STIX-based indicators Actions
Feature #1132: set rpath for libs not in the default linker paths Actions
Feature #1140: IP-Address white list implementation for IPS mode (without disable a rule global) Actions
Feature #1191: EVE log does not support customformat Actions
Feature #1194: Implement http_args keyword to match http arguments - query string or body Actions
Feature #1215: journald logging support Actions
Feature #1234: nfqueue: use mnl API Actions
Feature #1239: Best effort TCP stack Actions
Feature #1245: Add "drop-only" and "alert-only" option for pcap-log Actions
Feature #1250: Multipath TCP Actions
Feature #1290: handle SIGHUP signal Actions
Feature #1300: profiling: per flow recording of profiling data Actions
Feature #1323: automated eve.json rotation Actions
Feature #1348: OOBE -6- increasing max-pending-packets default value Actions
Feature #1380: JSON and Unified2 output "payload" does not contain full (or real in the case of Unified2) packets for session Actions
Feature #1389: suppress by host Actions
Feature #1469: Use ISO 8601 date/time formats Actions
Feature #1489: Log a message when memcap limit is reached Actions
Feature #1504: lua: better notification in verbose mode on script errors Actions
Feature #1505: lua: show lua scripts during rule (re)loading Actions
Feature #1520: multitenancy - verbose output clarity Actions
Feature #1541: multi-detect - vlan range mapping Actions
Feature #1566: ICMPv4 control channel detection Actions
Feature #1571: Socket permissions setting in suricata.yaml Actions
Feature #1590: lua: force file magic and md5 lookup from script Actions
Feature #1608: Add option to disable JSON escape slash Actions
Feature #1662: Disable action / rule ordering option Actions
Feature #1710: Unix socket: Send output to unix socket Actions
Feature #1712: multitenancy: 'lite' tenants Actions
Feature #1741: flow: use capture methods flow hash Actions
Feature #1750: Set Suricata to listen to all network interfaces when using AF_PACKET Actions
Feature #1752: Netmap for Windows Actions
Feature #1766: TLS keyword expansion Actions
Feature #1767: Support DTLS protocol Actions
Feature #1783: Create Suricata buffers to expose L2, L3, and L4 headers to Lua scripts Actions
Feature #1794: test suricata rules over unix-socket Actions
Feature #1799: netmap: capture drop stats Actions
Feature #1872: add --list-decoder-protos or similar Actions
Feature #1899: Detecting Malicious TCP Network Flows Based on Benford’s Law Actions
Feature #1939: Introduce packet/byte counter in stats.log/json for local bypass Actions
Feature #1950: allow configuration of file-store types Actions
Feature #1954: runtime option/flag to disable hardware timestamp support Actions
Feature #1956: Add option to re-initialise Lua output scripts Actions
Feature #1971: lua: make mandatory Actions
Feature #1977: get the os info from TCP HTTP fingerprint Actions
Feature #1979: TCP/IP packets normalization/scrubbing Actions
Feature #1995: fast.log should show if packet has been dropped or rejected Actions
Feature #2021: doc: sha256 filesum extraction missing in documentation Actions
Feature #2055: Optionally logging on files.json - Not log every file, only certain files that are stored and extracted Actions
Feature #2092: Improved support for xbits/hostbits - workers runmode Actions
Feature #2107: eve: rotate log output based on size Actions
Feature #2115: Changing interfaces Actions
Feature #2145: Relate directly flowid with certificate file Actions
Feature #2166: output: log only triggering buffers Actions
Feature #2167: eve-ng Actions
Feature #2174: Need a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET Actions
Feature #2198: Extend the DNS parser to accept dns_response keyword in signatures Actions
Feature #2213: file matching: allow generic file matching / store Actions
Feature #2227: more detailed output about number of threads created Actions
Feature #2232: Allow Large value in suricata.yaml file Actions
Feature #2233: Allow log for payload and packet only for defined sid Actions
Feature #2262: Unix Socket Output Configurable Retries and Blocking Actions
Feature #2273: engine analysis: enable analysis by default during startup Actions
Feature #2277: netinfo: structured information about the network. Output hierarchical network tree in events Actions
Feature #2280: http: rules that match both request and response Actions
Feature #2281: tcp stream: simpler IDS handling of overlap evasions Actions
Feature #2284: detect partial file transfers Actions
Feature #2291: traffic-id: ruleset for traffic classification and bypass Actions
Feature #2301: netflow: dump records at interval Actions
Feature #2308: threshold/suppress by http_host Actions
Feature #2310: lua: expose xbits Actions
Feature #2316: global memcap Actions
Feature #2319: Expose flow lifetime to the rulelanguage Actions
Feature #2342: Write PCAP files directly to Unix Socket Actions
Feature #2343: Add "flush" command to unix socket Actions
Feature #2363: pcap: read directories recursively Actions
Feature #2371: list all available /exposed fields to lua Actions
Feature #2380: [discussion] deprecate: 'alert syslog' output Actions
Feature #2388: smtp: log md5 of attachments Actions
Feature #2409: Push signatures without reloading the entire set. Actions
Feature #2410: Create a reset counter and track maximum number of parallel flows Actions
Feature #2426: tls: extend logging Actions
Feature #2487: Buffers for field/value pairs in http_uri and http_client_body Actions
Feature #2488: HTML Parsing / Buffers Actions
Feature #2513: Suricata read the SSLProxy header Actions
Feature #2519: XFF iprep support Actions
Feature #2538: dsize keyword improvements Actions
Feature #2569: multi-tenancy: allow mapping to 'device pair' in IPS mode Actions
Feature #2613: stats: add xdp counters to stats Actions
Feature #2628: Specify the flow direction in metadata sent by Suricata. Actions
Feature #2644: Add direction of stream to eve-json events Actions
Feature #2648: store captured data into file Actions
Feature #2661: output the http-body-data to eve.json Actions
Feature #2672: Split out DHCP parser to be reusable Actions
Feature #2673: Split out DNS parser to be reusable Actions
Feature #2674: Split out NFS parser to be reusable Actions
Feature #2675: Split out SMB parser to be reusable Actions
Feature #2681: Reloading of categories file, IP reputation list during rule live reload Actions
Feature #2695: websocket support Actions
Feature #2700: ja3/ja3s functionality for IKEv2 Actions
Feature #2701: flow: counter for allocations at runtime Actions
Feature #2713: protocol detection w/o protocol parsing Actions
Feature #2727: DCERPC UID to name mapping Actions
Feature #2746: Use Available Instruction Set Specialization (AVX2 and AVX512) in Hyperscan when available Actions
Feature #2755: vendor id / vid keyword to give rulesets unique sid ranges Actions
Feature #2756: rules: input in json format Actions
Feature #2757: improve protocol detection Actions
Feature #2759: iprep: more granularity Actions
Feature #2764: dns logging v1 vs v2 Actions
Feature #2767: Interception of network stack attacks Actions
Feature #2771: MPLS over Vlan support Actions
Feature #2772: Add MPLS labels to alert output Actions
Feature #2818: Napatech Bypass support Actions
Feature #2860: Suricata doesn't detect part of IKEv2 traffic Actions
Feature #2871: lua: Exposing byte extract to script Actions
Feature #2925: Support for SPB encapsulation Actions
Feature #2931: Perform privdrop without libcap-ng support Actions
Feature #2932: add batman-adv decode support Actions
Feature #2935: Support for multiple-logger for drop eve-log Actions
Feature #2939: Suricata enhancements - proposals Actions
Feature #2957: Suricata x Moloch - protocol detection. Proposals for TLS/SSL Actions
Feature #2962: eve: log more IKEv2 fields Actions
Feature #2987: Suggestions for new keywords (streambits) Actions
Feature #2996: Extend decode events and rules Actions
Feature #3042: stats: allow per second stats updates Actions
Feature #3105: Add kafka output Actions
Feature #3212: Prevent duplicate pcaps from being re-processed Actions
Feature #3243: POP3 Support Actions
Feature #3244: IMAP Support Actions
Feature #3245: Email extraction to separate folder Actions
Feature #3246: Logging of Email body Actions
Feature #3260: SMTP Base64 Decoding of Message Body Actions
Feature #3261: SMTP quoted-printable Decoding of Message Body Actions
Feature #3271: Add keyword to determine flow based speed/bw Actions
Feature #3290: use config vars everywhere Actions
Feature #3295: Unix socket: support to receive flow shunting information Actions
Feature #3296: Include in the fileinfo if it was a duplicate Actions
Feature #3298: Create a config flag in the DNS logger to limit events to only the ones in the custom field Actions
Feature #3306: Support AF_XDP capture method Actions
Feature #3310: ease suricata configuration with xdp Actions
Feature #3311: Add better default suricata configuration for different traffic sizes and cpu/system architectures Actions
Feature #3316: Unix socket: support dumping flow table Actions
Feature #3317: rules: use rust for tokenizing rules Actions
Feature #3319: on 'wrong thread' reinject packets to correct thread Actions
Feature #3321: Evaluate different encoders for eve-log Actions
Feature #3338: vxlan: log vni in eve Actions
Feature #3351: sip: parse traffic over tcp Actions
Feature #3373: add init service file example script for Debian/Ubuntu Actions
Feature #3383: nflog: use mnl api Actions
Feature #3446: app-layer: implement MySQL parser Actions
Feature #3548: Support GTP(GPRS Tunnelling Protocol). Actions
Feature #3629: Publish the Suricata support Python libraries to PyPI (make pip installable) Actions
Feature #3663: DNS: Parse and extract DNS NULL records Actions
Feature #3675: Testimony support Actions
Feature #3688: Re-implement fast_pattern:only; in some way Actions
Feature #3953: 8021BR E packet decoder Actions
Feature #4093: Extend stats log to print packet and byte rate on protocols Actions
Feature #4140: IEC104 Protocol Support Actions
Feature #4147: Map rules to MITRE ATT&CK Actions
Feature #4148: Research: SSH Support for additional protocol analysis Actions
Feature #4149: Research: Dynamic datasets Actions
Feature #4150: Profiling mode: Ticks used to generate an alert available? Actions
Feature #4175: dcerpc: higher level logging Actions
Feature #4249: SS7 Protocol Support Actions
Feature #4250: Diameter Protocol Support Actions
Feature #4381: flowbits: warn if flowbit dependencies don't follow suricata inspection order Actions
Feature #4398: support regex match and flowvars as keywords value Actions
Feature #4547: pcrexform not support tcp and other protocol Actions
Feature #4573: add IPS drop total to eve log output Actions
Feature #4853: eve: Add information about Suricata version Actions
Feature #4951: datalink type 276 not yet supported Actions
Feature #4974: Log references to Eve Actions
Feature #4985: quic: support frames Actions
Feature #5051: output/frames: allow tx logging to reference frames Actions
Feature #5067: smb/dcerpc: Match dcerpc (over smb) requests before bind_ack Actions
Feature #5069: smb: SMB keyword for match the smb command Actions
Feature #5075: smb: keyword for the SMB version Actions
Feature #5128: Light weight packet profiling Actions
Feature #5148: IPS mode for Napatech Card Actions
Feature #5152: Anomaly: CredSSP support addition to Suricata anomaly parsing Actions
Feature #5184: Add more dataset user interaction Actions
Feature #5206: Buffer Dump Utility Actions
Feature #5209: Add "status" mode to Suricata's socket command interface Actions
Feature #5217: ips: allow dropping of flow if applayer specific memcap is hit Actions
Feature #5219: ips: add 'master switch' to enable dropping on traffic (handling) exceptions Actions
Feature #5245: allow fast_pattern on base64_data strings Actions
Feature #5365: Limit rust 'filetracker' memory in configuration Actions
Feature #5383: Support for IP addresses in dataset Actions
Feature #5384: Thread Synchronisation: wait for all threads to be in an operating state before continuing initialisation Actions
Feature #5405: Make suricata point to where to report a bug Actions
Feature #5411: Add keywords for user and domain seen in smb Actions
Feature #5413: DCERPC logging is not easy to use in analysis Actions
Feature #5415: tftp: support keywords such as file.name, file.data etc... Actions
Feature #5440: multiple stats EVE logs with different intervals Actions
Feature #5446: allow ranges in dns.opcode value Actions
Feature #5450: Rule keyword for non midstream flows Actions
Feature #5461: eve: Use threaded output by default Actions
Feature #5466: detect: allow alert-then-pass logic Actions
Feature #5469: rules: expose per flow stream.midstream setting to the rule language Actions
Feature #5470: reject: allow reject dev to be specified in the yaml Actions
Feature #5479: Add landlock support Actions
Feature #5489: research: multi version rules; or version dependent rules Actions
Feature #5495: implement grace period for midstream exception policy Actions
Feature #5499: PCAP-over-IP client Actions
Feature #5516: tls: client cert detection Actions
Task #570: tracking: memory fragmentation Actions
Task #2278: tracking: failing better Actions
Task #2313: tracking: save & restore state when suricata restarts Actions
Task #2685: SuriCon 2018 brainstorm Actions
Task #2778: tracking: port app-layer parsers to Rust Actions
Task #2975: convert unittests to new FAIL/PASS API Actions
Task #3016: No documentation for "endswith" keyword Actions
Task #3153: tracking: scan-build warnings Actions
Task #3195: tracking: rustify all input Actions
Task #3291: collect common mistakes rulewriters might run into Actions
Task #3294: Test the maximum size for messages passed to the unix socket Actions
Task #3299: Tracking: Add support for industrial protocol Actions
Task #3300: Tracking: Add support for medical protocols Actions
Task #3301: Research: Failover support within the current IPS implementation Actions
Task #3302: Research: ruleset optimizations Actions
Task #3307: Research: evaluate future of lua support in Suricata Actions
Task #3318: Research: NUMA awareness Actions
Task #3329: Research: WASM as a Lua alternative and for dynamically loadable modules Actions
Task #3554: modbus: support GAP recovery Actions
Task #3803: Research: use nom-derive Actions
Task #3828: pfring support: remove in favor of (externally maintained) plugin Actions
Task #4067: http2: overload existing http keywords to support http/2 Actions
Task #4146: Research: Hand off packet streams on alerts Actions
Task #4151: Research: New protocol support Actions
Task #4252: SCTP: session tracking Actions
Task #4380: tracking: improvements to bits, ints, vars Actions
Task #4431: libsuricata: Example showing libsuricata as a replacement for libnids (network grep) Actions
Task #4714: Improve unittests coverage for Suricata's application layers rust nom parsers Actions
Task #4915: transversal: update references to suricata webpage Actions
Task #5052: unittest: create test for checking all app_proto registrations Actions
Task #5074: rules: structured rule input Actions
Task #5181: detect/engine-analyzer: add rule analyzer warnings about rules that could use the frame keyword/semantics/feature Actions
Task #5195: tracking: give more insight into detection pipeline Actions
Task #5256: rust: see if we can reduce number of crate deps Actions
Task #5257: ci: cargo audit job Actions
Task #5433: tracking: reduce number of public data structures Actions
Task #5460: eol: include EOL dates in a per branch file in the repo Actions
Task #5496: detect/parse: add tests for parsing signatures with reject and drop action Actions
Task #5504: exceptions: error out when invalid configuration value is passed Actions
Task #5510: stream (midstream): investigate - Suri drops flow but still logs second packet of the flow Actions
Documentation #595: document csum keywords Actions
Documentation #1233: Documentation for each keyword in stats.log file. Actions
Documentation #1691: Docs: Convert windows docs Actions
Documentation #1892: rule docs should include example rules Actions
Documentation #1974: DNP3: document lua support Actions
Documentation #2016: doc: improve keywords self documentation Actions
Documentation #2266: no documentation for file-store-waldo Actions
Documentation #2404: Windows Installation Guide for Suricata bug Actions
Documentation #2470: Suricata does not always alert on traffic with content that matches rules Actions
Documentation #2585: document replace keyword Actions
Documentation #2588: document hostbits keyword Actions
Documentation #2589: document decode-event Actions
Documentation #2620: Documentation: tagged_packets / event_type packet Actions
Documentation #2699: document all eve record types and fields Actions
Documentation #2976: review userguide from beginners point of view Actions
Documentation #3015: Missing documentation for "tag" keyword Actions
Documentation #3018: No documentation for "flowvar" keyword Actions
Documentation #3019: No documentation for "pktvar" keyword Actions
Documentation #3022: No documentation for "nfq_set_mark" keyword Actions
Documentation #3023: No documentation for "bsize" keyword Actions
Documentation #3025: Missing docs for "http." keywords Actions
Documentation #3027: No documentation for "nfs" keywords Actions
Documentation #3028: No documentation for "pkt_data" keyword Actions
Documentation #3030: doc: document for "smb" keywords Actions
Documentation #3031: No documentation for "asn1" keyword Actions
Documentation #3032: No documentation for "engine-event" keyword Actions
Documentation #3033: No documentation for "stream-event" keyword Actions
Documentation #3034: No documentation for "l3_proto" keyword Actions
Documentation #3035: No docs for "base64_" keywords Actions
Documentation #3036: No documentation for "template2" keyword Actions
Documentation #3046: Document each default value from the config Actions
Documentation #3180: tracking: document all decoder and app-layer events Actions
Documentation #3181: document http engine events Actions
Documentation #3222: Configuring ipv6 Actions
Documentation #3268: Add links to additional information at the wiki to the userguide Actions
Documentation #3274: doc: some inconsistency between http docs keywords description Actions
Documentation #3303: Add a documentation about the used sid and gid ranges Actions
Documentation #3313: Document 40Gbps IPS set up Actions
Documentation #3748: Add documentation for flags keyword Actions
Documentation #4584: Rust doc: add docstring to rust module files Actions
Documentation #4658: Add/improve documentation for pcre substring capture logging Actions
Documentation #4662: Add documentation section covering Suricata rule grammar Actions
Documentation #4697: devguide: document app-layer frame support Actions
Documentation #4706: Guide for rulewriting Actions
Documentation #4709: Add page about Analizing Suricata performance Actions
Documentation #4768: DNS v2 EVE does not longer contain `dns.rdata` but it is still listed in the documentation Actions
Documentation #4929: devguide: bring Contributing process page into it Actions
Documentation #5068: nfs: document rule keyword Actions
Documentation #5088: file.name sticky buffer is not documented Actions
Documentation #5129: devguide: clarify style guide for getframe functions Actions
Documentation #5182: userguide: better document rule keywords Actions
Documentation #5225: testing/fuzz: improve documentation on how to fuzz suricata Actions
Documentation #5267: Meaning of insert_list_fail counter Actions
Documentation #5274: devguide: document how the alert flow works Actions
Documentation #5359: userguide: improve documentation on (main) EVE fields Actions
Documentation #5367: byte_test: all examples in doc missing a required argument Actions
Documentation #5375: Improve documentation for TLS logging options Actions
Documentation #5393: devguide: move github workflow document from redmine into devguide Actions
Documentation #5449: userguide: document how suricata processes rules internally Actions
Documentation #5484: userguide: explain content modifiers usage with regards to position usage in the rule Actions
Documentation #5485: userguide: explain that the http.header_names buffer is normalized Actions
Documentation #5487: userguide: add explanation on how depth of inspection affects rules Actions
Documentation #5494: userguide: update tls eve-log fields 'not_before' and 'not_after' Actions
Documentation #5512: userguide: add subsection about setting up Suri in IPS mode with Netmap Actions
Documentation #5513: userguide: add a chapter for IPS mode Actions
Documentation #5514: userguide: document exception policy from an extreme profiling and tuning perspective Actions
Documentation #5515: userguide: add a dedicated chapter/section for the Exception Policies Actions
Documentation #5519: userguide: update 'dsize' examples and documentation Actions
Documentation #5523: userguide: document the tcp-stream keyword Actions
Documentation #5531: userguide: ensure documentation is up to date Actions
Documentation #5532: userguide: have a section to mention and document the various ways stream-depth can be set Actions
Documentation #5534: userguide: better document what TCP midstreams are for Suricata Actions
Documentation #5537: devguide: add section/chapter about how [capture] bypassing works for Suricata Actions
Documentation #5542: userguide: add section about landlock under Config hardening Actions
Documentation #5543: userguide: document which keywords accept the prefilter keyword Actions