Project

General

Profile

Roadmap

8.0.7

open

Due in 50 days (09/08/2026)

0%

45 issues   (0 closed — 45 open)

Related issues
JF Feature #7942: exception-policy: stream async policy (8.0.x backport) Actions
LS Feature #8085: dpdk: in dpdk runmode initiialize EAL threads (8.0.x backport) Actions
LS Feature #8228: hyperscan: test cache creation and pruning in CI (8.0.x backport) Actions
LS Feature #8229: dpdk: recognize net_pcap driver and stop after no packets are rx_bursted (8.0.x backport) Actions
JL Feature #8234: rules: extend byte_extract named variables for use in other keywords/transformations such as xor (8.0.x backport) Actions
JF Feature #8340: stream/tcp: add counter(s) for stream async (8.0.x backport) Actions
JL Feature #8402: detect/thresholds: add telemetry for bucket depths (8.0.x backport) Actions
JI Feature #8565: firewall: support FTP-data hook states for firewall rule evaluation (8.0.x backport) Actions
YD Feature #8729: firewall: allow single rule to accept protocol detection in progress and the final protocol (8.0.x backport) Actions
VJ Feature #8747: firewall: support HTTP2 hook states for per-frame accept/drop decisions (8.0.x backport) Actions
JI Documentation #7913: userguide: document transaction loggers can be registered from a plugin (8.0.x backport) Actions
VJ Documentation #7918: doc/userguide: document terminating behavior of rule actions (8.0.x backport) Actions
JF Documentation #7930: userguide: document behavior for actions like PASS, DROP, REJECT, BYPASS... (8.0.x backport) Actions
JF Documentation #7933: devguide: document how the alert flow works (8.0.x backport) Actions
JF Documentation #7944: eve/schema: document stats.decoder counters (8.0.x backport) Actions
OD Documentation #7945: doc/actions: clarify 'pass' scope variations (8.0.x backport) Actions
OD Documentation #7946: userguide: add section on SMTP event type (8.0.x backport) Actions
OD Documentation #7947: doc/configuration: clarify sig_id & gid_id for global threshold (8.0.x backport) Actions
LS Documentation #8345: doc: update Rust install instructions (8.0.x backport) Actions
OD Security #8701: unix-socket: TOCTOU race in Unix socket directory creation (8.0.x backport) Actions

9.0.0-beta1

open

Due in about 9 months (04/06/2027)

44%

746 issues   (303 closed — 443 open)

Related issues
PA Feature #635: output: missing keywords in list-keywords output Actions
PM Feature #682: Add DEP and ASLR to Windows Binary Actions
VJ Feature #1005: conditional logging: controlling what gets logged Actions
JI Feature #1542: dump-config - extend into multi-detect supplied yaml configuration Actions
VJ Feature #1954: af-packet: runtime option/flag to disable hardware timestamp support Actions
VJ Feature #1979: TCP/IP packets normalization/scrubbing Actions
OD Feature #1983: tls: events are directionless and trigger twice per flow direction Actions
OD Feature #1993: commandline: introduce --enable-all-outputs switch Actions
OD Feature #2375: Design and implement sensible per-thread capabilities Actions
JI Feature #2448: dns: additional buffers for DNS Responses Actions
PA Feature #2487: rules: buffers for field/value pairs in http.uri and http.client_body Actions
OD Feature #2678: list-keywords: add info about fast_pattern and transforms Actions
SB Feature #2727: dcerpc: UUID to service name mapping Actions
JL Feature #2958: Suricata 5.0.0beta1 and way too much anomaly logging Actions
JI Feature #3003: filestore to uses rename syscall instead of sendfile,which doesn't allow files to be sent across file systems Actions
PM Feature #3026: Windows MSI - add in service scripts Actions
PA Feature #3065: tls_cert_XX keywords date format parsing error Actions
JF Feature #3236: output: list-keywords does not match on aliases Actions
AS Feature #3243: POP3 Support Actions
OD Feature #3338: vxlan: log vni in eve Actions
GL Feature #3446: app-layer: implement MySQL parser Actions
OD Feature #3636: eve: configuration options to enable all, none or just a default set of outputs Actions
FZ Feature #3953: 8021BR E packet decoder Actions
JL Feature #4082: ftp: convert parser to Rust Actions
JL Feature #4089: rules: Flexible format transform Actions
OD Feature #4098: smtp: convert parser to Rust Actions
JI Feature #4136: configure: use Suricata-Update managed classification.config Actions
JI Feature #4153: app-layer: rust derive style macros to generate common code Actions
OD Feature #4161: tls: convert parser to Rust Actions
VJ Feature #4174: tracking: app-layer frame inspection support Actions
JL Feature #4226: bsize: apply as depth to patterns Actions
GL Feature #4251: protocol: SCTP support Actions
JF Feature #4566: pgsql: add subprotocol-states Actions
JI Feature #4782: config: add command to dump all active settings Actions
JF Feature #4854: pgsql: Add COPY subprotocol-state Actions
JI Feature #4855: rules: refactor rule parsing into multi-stage parser Actions
PA Feature #4861: smb: support multi-stream file transfers Actions
JL Feature #4876: Additional FTP Buffers Actions
OD Feature #4906: ftp: add stream app-layer frame support Actions
LS Feature #4910: dpdk: implement secondary mode Actions
OD Feature #4919: Add option to change sensor-name log field Actions
OD Feature #4946: nfsv2: implement WRITE support Actions
VJ Feature #4965: protocol: SOCKS support Actions
JF Feature #4986: pgsql: support frames Actions
OD Feature #4990: eve/frames: make payload logging configurable Actions
OD Feature #5029: eve: telnet logger Actions
PA Feature #5044: rules: keyword for "count" of http_header_names Actions
VJ Feature #5049: detect/frames: allow mixing with txs Actions
VJ Feature #5194: tracking: options for simulating various exceptions Actions
LS Feature #5203: dpdk: implement primary app for Suricata secondary mode Actions
OD Feature #5217: ips: allow dropping of flow if applayer specific memcap is hit Actions
JF Feature #5286: ips: allow dropping of packet/flow when alert queue exceeded Actions
OD Feature #5415: tftp: support keywords such as file.name, file.data etc... Actions
OD Feature #5495: implement grace period for midstream exception policy Actions
PA Feature #5576: Dataset is setting data despite the signature being a complete match Actions
OD Feature #5640: frames: tx frames Actions
JI Feature #5642: DNS: parity between log fields and detection Actions
OD Feature #5726: ike: add frame support Actions
PA Feature #5775: rules: http.headers - dynamic sticky buffers Actions
VJ Feature #5826: frames: logging of events set on frames Actions
AK Feature #5838: dpdk: NIC encapsulation stripping Actions
PA Feature #5845: smb: Support SMB_COM_SESSION_SETUP_ANDX Request Actions
OD Feature #5973: warn when HTTP rules will only work for a specific version of HTTP Actions
VJ Feature #5974: flow: midstream exception policy "reject-both" support Actions
MM Feature #6012: dpdk: add support for segmented mbufs Actions
JF Feature #6063: exception-policy: stream async policy Actions
PA Feature #6091: eve/alert: missing dhcp metadata Actions
LS Feature #6114: dpdk: wrap DPDK logs in a Suricata logger Actions
JF Feature #6210: outputs: add verdict event type Actions
OD Feature #6214: multi-tenant: suricatasc command with parity with non-tenant commands for rules Actions
PA Feature #6216: http: HHHash support Actions
JL Feature #6237: Multi-tenancy: Allow inner VLAN to be selected Actions
TW Feature #6261: Add GRE as a parsible protocol Actions
CD Feature #6293: Support disabling forced flow reuse in low memory conditions Actions
VJ Feature #6368: stream/midstream: wscale setting Actions
OD Feature #6399: Per-thread stats values can be negative Actions
PA Feature #6409: lua: add HTTP/2 lib Actions
LS Feature #6422: dpdk: expand on DPDK allocation hints Actions
OD Feature #6424: HTTP/2 - http.host behavior when both :authority pseudo header and host header are present Actions
SB Feature #6459: filebits: support for new type of bits Actions
OD Feature #6472: HTTP/3 support Actions
OD Feature #6474: detect: smtp body inspection keyword Actions
OD Feature #6651: quic: detect on non-standard ports Actions
JL Feature #6693: detect/byte_jump: add support for bitmask option Actions
PA Feature #6723: detect: review existing keywords for usage of enumerations Actions
PA Feature #6724: detect: review existing keywords for usage of bitflags Actions
PA Feature #6729: websocket: support over HTTP/2 Actions
VJ Feature #6831: rules: support extraction of bytes of non-numeric values Actions
LS Feature #6927: dpdk: add unit tests for threading and mempool cache size functions Actions
OD Feature #6936: landlock: enable by default Actions
GL Feature #6956: mqtt: create PDU frames without regard to the parsing function Actions
OD Feature #6996: add transformation to keyword performance stats Actions
JH Feature #6999: output/json: enrich EVE w/ libmaxminddb geoip info Actions
FZ Feature #7062: redis: support authenticating against a redis server Actions
JF Feature #7068: protocol support: STUN Actions
VJ Feature #7070: eve: internal state output facility Actions
VJ Feature #7092: frames: support rules with multiple different frames Actions
OD Feature #7109: app-layer: stop generating anomalies after gap in the flow Actions
JL Feature #7114: from_base64: allow matching on decode error Actions
LS Feature #7117: dpdk: hardware timestamping for packets Actions
OD Feature #7125: threshold: by_src, by_dst, by_both should support vlan separation Actions
PA Feature #7177: http1: add frame support Actions
PA Feature #7211: detect/integers: support a count argument for array of integers Actions
VJ Feature #7245: Add SIMD support for arm64 Actions
JL Feature #7313: transforms: have option on how to handle failure Actions
EL Feature #7347: eve/alert: log file_data Actions
JL Feature #7351: transform/from_base64: Support "relative" offsets Actions
SB Feature #7354: detect: reimplement ip-only as a per group prefilter Actions
JL Feature #7399: ipv6: support short notation of ipv6 addresses in output Actions
JI Feature #7401: yaml: add schema Actions
SB Feature #7438: detect: add flow.rate keyword Actions
OD Feature #7470: detect/ldap: add ldap.bind.version keyword Actions
PA Feature #7480: detect/integers: array of integers should support an optional second argument to specify the index Actions
OD Feature #7514: rules: add file specific hooks Actions
LS Feature #7519: dpdk: verify the driver is DPDK-compatible on Intel cards Actions
OD Feature #7534: detect/ldap: add ldap.request.message_id and ldap.responses.message_id Actions
OD Feature #7536: detect/ldap: add keywords for LDAP BindRequest Actions
OD Feature #7537: detect/ldap: add keywords for LDAP SearchRequest Actions
OD Feature #7538: detect/ldap: keyword ldap.modify_request.operation Actions
OD Feature #7539: detect/ldap: add keyword ldap.mod_dn_request.new_rdn Actions
SB Feature #7566: dcerpc: applayer events for anomalous parsing results Actions
PA Feature #7571: list-keywords should somehow show the multi-buffer keywords Actions
OD Feature #7586: mime: expose 'headers' as a keyword Actions
AD Feature #7587: mime: add email.body_md5 keyword Actions
OD Feature #7600: mime: add rule keywords Actions
AK Feature #7629: dpdk: support for a hardware-accelerated input drop filter Actions
JF Feature #7646: pgsql: add CopyBoth subprotocol/mode Actions
PA Feature #7666: rust: zero-dependency crate suricata-ffi Actions
JL Feature #7672: detect/transforms: subslice transform Actions
PA Feature #7674: source/tunnels: config option to distinguish tunnels Actions
LS Feature #7691: detect: explore code embedded relationships between registered keywords Actions
JF Feature #7699: firewall: separate stats for ips and firewall Actions
VJ Feature #7701: firewall: configurable default policies Actions
YD Feature #7704: firewall: allow single packet rule to accept tcp connection Actions
YD Feature #7705: firewall: allow single rule to accept protocol detection in progress and the final protocol Actions
VJ Feature #7711: tracking: detect: add detection hooks to inspect/drop before stateful components Actions
PA Feature #7717: vxlan: treat as its own tunnel Actions
LS Feature #7739: github-ci: add PCAP file reading tests Actions
VJ Feature #7768: ips: improve file.data support Actions
OD Feature #7786: pcap: Enhance --pcap-file-delete to Conditionally Delete PCAPs Based on Alerts Actions
JL Feature #7801: rules: support multi-buffer byte variables Actions
EL Feature #7816: Add alternative to file magic Actions
LS Feature #7830: hyperscan: support cache invalidation and removal Actions
LS Feature #7832: github-ci: add live hyperscan caching tests Actions
PA Feature #7846: rules/transform: add gunzip transform Actions
JL Feature #7847: rules: extend byte_extract named variables for use in other keywords/transformations such as xor Actions
VJ Feature #7848: rules: extend pcrexform for use outside of existing suricata buffers Actions
AK Feature #7871: dpdk: rte_flow capture bypass Actions
PA Feature #7875: list-keywords should somehow show the integer keywords Actions
OD Feature #7894: output: log http2.window when needed Actions
PA Feature #7904: http: support zstd compression Actions
OD Feature #7928: rules: distinct counting logic Actions
PA Feature #7929: detect/integers: support optional second argument to specify the index for all keywords Actions
OD Feature #7955: c: create files with explicit permissions Actions
OD Feature #7956: rust: create files with explicit permissions Actions
VJ Feature #7979: sslproxy: add support for parsing decrypted traffic Actions
DP Feature #7986: protocol decoder: l2tpv3 Actions
OD Feature #7995: pop3: email mime parsing Actions
JL Feature #8006: nfs: NFSv4 should support 4.1's new enums Actions
LS Feature #8084: dpdk: in dpdk runmode initialize EAL threads Actions
OD Feature #8099: multi-tenant: optionally reload tenant rules on SIGUSR2 Actions
PA Feature #8116: Quic: encryption-handling config parameters Actions
SB Feature #8117: rules: flow.elephant keyword Actions
PA Feature #8128: rules/transform: add json_decode transform Actions
PA Feature #8130: http: http.uri should normalize the + into space as per RFC 1886 Actions
AI Feature #8138: windivert: Build using WinDivert 2 Actions
JI Feature #8139: defrag: alert on / reject >=3 layer overlaps Actions
VJ Feature #8174: frames: add --list-frames option Actions
PA Feature #8179: dcerpc.opnum: doesn't support operators >,<,!,= Actions
PA Feature #8222: nfs: log detailed response for versions other than v3 Actions
MM Feature #8225: dpdk: recognize net_pcap driver and stop after no packets are rx_bursted Actions
LS Feature #8227: hyperscan: test cache creation and pruning in CI Actions
OD Feature #8250: rules: distinct ip counting logic Actions
VJ Feature #8262: decoder: add IGMP support Actions
GL Feature #8276: imap: add parser, logger and sticky buffers Actions
VJ Feature #8285: firewall: support iprep in firewall mode Actions
JL Feature #8286: output: improve flushing coverage Actions
LS Feature #8320: dpdk: add Github CI live run tests for DPDK virtual devices Actions
LS Feature #8322: hs: add pruning stats details of removal reason Actions
LS Feature #8324: config: aggregate configuration node paths for mpm/spm settings Actions
VJ Feature #8327: detect: add eth.hdr keyword for inspecting ethernet header Actions
LS Feature #8334: firewall: allow matching on packet layers Actions
JF Feature #8335: pgsql: add keywords for better detection and coverage Actions
JF Feature #8339: stream/tcp: add counter(s) for stream async Actions
GL Feature #8359: protocol: add ssdp parser Actions
JF Feature #8361: stream/tcp: add flags keyword Actions
GL Feature #8366: protocol: add support for llmnr Actions
JI Feature #8384: dns: add dns.rdata keyword Actions
AA Feature #8385: datasets: add support for subdomain match Actions
VJ Feature #8386: firewall: support HTTP2 hook states for per-frame accept/drop decisions Actions
JI Feature #8392: firewall: support FTP hook states for firewall rule evaluation Actions
JI Feature #8393: firewall: support SMTP hook states for firewall rule evaluation Actions
JI Feature #8394: firewall: support NTP hook states for firewall rule evaluation Actions
PA Feature #8395: firewall: support SNMP hook states for firewall rule evaluation Actions
JL Feature #8401: detect/thresholds: add telemetry for bucket depths Actions
Feature #8403: smb: add samr_UserInfo details to EVE logs Actions
OD Feature #8407: eve: in bridge mode, enable ethernet logging by default Actions
JI Feature #8408: firewall: support FTP-data hook states for firewall rule evaluation Actions
JI Feature #8425: ntp: add ntp transaction logging Actions
OD Feature #8426: rdp: applayer events for anomalous parsing results Actions
JI Feature #8429: rules: add ntp.mode keyword Actions
JI Feature #8430: rules: add ntp.version keyword Actions
JI Feature #8431: rules: add ntp.stratum keyword Actions
LS Feature #8434: firewall: allow interfaces to be specified to provide direction Actions
JI Feature #8456: firewall: source field in alert/drop events to distinguish firewall from IDS/IPS Actions
JF Feature #8459: firewall: support bypass option with firewall rules Actions
VJ Feature #8472: firewall: Auto-Accept Prior States syntax for firewall mode intent rules Actions
JI Feature #8477: rust/ffi: provide eve callback Actions
VJ Feature #8480: firewall: allow specifying multiple actions Actions
PA Feature #8485: snmp: add snmp.trap_oid keyword Actions
PA Feature #8486: snmp: add snmp.trap_address keyword Actions
JI Feature #8488: ntp: use a buffer for reference id, not a u32 Actions
SS Feature #8499: Exception Policy key to be made available for netflow logs Actions
VJ Feature #8514: firewall: analyzer: complete rule table coverage Actions
OD Feature #8516: http: include server header in default eve record as a field Actions
OD Feature #8520: quic: include server header in default eve record as a field Actions
SB Feature #8523: dcerpc: map opnum to the function names Actions
GL Feature #8524: sip: sip-event.rules file is missing Actions
JI Feature #8533: ntp: add lua bindings for ntp transactions Actions
SS Feature #8538: dhcp: support option 52 overload Actions
VJ Feature #8566: firewall: support generating alerts on default policy Actions
JF Feature #8575: firewall: show app-layer state with --list-keywords Actions
KS Feature #8594: Logging Tcp fingerprints from the ndpi 5 plugin Actions
JI Feature #8597: rust/ffi: add safe wrapper over raw packet pointer Actions
JI Feature #8598: rust/ffi: add safe wrapper over raw threadvars pointer Actions
JI Feature #8599: rust/ffi: add safe wrapper over raw flow pointer Actions
VJ Feature #8601: firewall: drop action should not imply alert Actions
JI Feature #8605: rust/ffi: add rust wrappers around thread lifecycle callbacks Actions
EL Feature #8606: landlock: handle newer filesystem access rights for ABI V3/V5 Actions
OD Feature #8612: GRE tracking in the flow Actions
PA Feature #8675: detect/integers: auto-document list of possible values Actions
LS Feature #8712: firewall: add default app policy options Actions
OD Feature #8714: firewall: clamp protocol to flow Actions
SB Feature #8721: dcerpc: match on service name via rules Actions
VJ Feature #8727: rules: allow specifying a sub state w/o hook Actions
SB Feature #8733: detect: rule keyword for dcerpc.ptype Actions
SB Feature #8734: detect: rule keyword for dcerpc.flags Actions
SB Feature #8735: detect: rule keyword for dcerpc.header Actions
SB Feature #8736: detect: rule keyword for dcerpc.is_fragmented Actions
OD Documentation #2620: userguide: document tagged_packets / event_type packet Actions
JF Documentation #3028: No documentation for "pkt_data" keyword Actions
OD Documentation #4350: doc/devguide: transaction handling logic Actions
OD Documentation #4352: Devguide: Debugging Basics - pcap_cnt Actions
JF Documentation #4557: Add document about JsonBuilder Actions
JL Documentation #4658: Add/improve documentation for pcre substring capture logging Actions
VJ Documentation #4705: userguide: add sections about frame support Actions
JI Documentation #4708: devguide: Add Eve Output Plugins Actions
OD Documentation #4709: userguide: Add page about analyzing Suricata performance Actions
VJ Documentation #4980: doc/frames: document frame rule keyword Actions
OD Documentation #5008: userguide: add a protocol chart listing defaults Actions
VJ Documentation #5030: rules/endswith: doc wrong for offset/distance/within warning Actions
PA Documentation #5267: Meaning of insert_list_fail counter Actions
JF Documentation #5274: devguide: document how the alert flow works Actions
VJ Documentation #5465: doc/userguide: document terminating behavior of rule actions Actions
OD Documentation #5477: Json schema doesn't support thread stats Actions
JF Documentation #5532: userguide: have a section to mention and document the various ways stream-depth can be set Actions
VJ Documentation #5534: userguide: better document what TCP midstreams are for Suricata Actions
VJ Documentation #5543: userguide: document which keywords accept the prefilter keyword Actions
JF Documentation #5554: userguide: document behavior for actions like PASS, DROP, REJECT, BYPASS... Actions
JF Documentation #5575: docs: bring 'reporting bugs page' into userguide and update it Actions
JF Documentation #5612: devguide: add a chapter about Suricata's exception policies Actions
JF Documentation #5829: userguide: add context on "why/when an exception policy is applied" Actions
JF Documentation #5830: userguide: update & improve exception policy section Actions
OD Documentation #5869: userguide: describe what are the delta stats counters Actions
JF Documentation #5891: userguide: explain different log save directory in offline mode Actions
OD Documentation #5897: devguide: add section on generating code coverage reports locally Actions
OD Documentation #5910: devguide: explain possible differences in data inspection with inline stream or not Actions
OD Documentation #6026: userguide/suricata-yaml: update image on threading Actions
JF Documentation #6030: devguide: expand Suricata Internals chapter Actions
JT Documentation #6058: doc/configuration: clarify sig_id & gid_id for global threshold Actions
PA Documentation #6075: eve/schema: document http Actions
JF Documentation #6078: eve/schema: document pgsql Actions
PM Documentation #6096: eve/app-layer: generate example eve-log for each protocol Actions
JI Documentation #6097: eve/dhcp: generate example dhcp output Actions
JI Documentation #6098: eve/dns: generate example dns output Actions
OD Documentation #6180: userguide: add troubleshooting section Actions
OD Documentation #6219: userguide: add page about different usecases Actions
VJ Documentation #6369: stream: document stream.3whs_syn_flood and stream.3whs_synack_flood Actions
CT Documentation #6406: userguide: remove ambiguous "we" usages Actions
JI Documentation #6412: devguide: API upgrade notes Actions
SB Documentation #6434: eve/schema: document stats Actions
OD Documentation #6442: rtd: indicate that a page is for an outdated version Actions
OD Documentation #6451: userguide: update 'what is suricata' section Actions
JL Documentation #6452: userguide/ftp: clarify usage around ftp and ftp.data keyword Actions
OD Documentation #6484: userguide: add keyword performance results Actions
OD Documentation #6486: userguide: explain pkt_on_wrong_thread counter Actions
JL Documentation #6492: doc: explain how FTP works Actions
OD Documentation #6495: userguide: add section on SMTP event type Actions
OD Documentation #6626: devguide: add instructions for MacOS setup Actions
PO Documentation #6824: doc: Document every parameter of the configure script Actions
OD Documentation #7174: docs: investigate if RtD AddOns will impact our guides Actions
OD Documentation #7277: doc/actions: clarify 'pass' scope variations Actions
VJ Documentation #7348: userguide: explain SYSTEM and USER mode Actions
OD Documentation #7424: devguide: document pseudo packets Actions
OD Documentation #7580: userguide: add section for negated content Actions
VJ Documentation #7662: userguide: add section for rule hooks Actions
VJ Documentation #7680: userguide: document tx scoped xbits Actions
JF Documentation #7722: docs: add a glossary chapter Actions
OD Documentation #7755: doc: document ethtool offloads for common use Actions
JF Documentation #7793: eve/schema: document stats.decoder counters Actions
JS Documentation #7806: Keywords missing documentation Actions
JI Documentation #7840: userguide: document transaction loggers can be registered from a plugin Actions
OD Documentation #7921: docs: disambiguate 'frame' word usage Actions
JF Documentation #7937: docs: update backports policy for Suricata 7.0.x Actions
OD Documentation #7953: doc: umask option not documented Actions
OD Documentation #8011: userguide: document behavior/support for stream.async-oneside Actions
VJ Documentation #8031: isdataat: document different semantics between absolute and relative modes Actions
JL Documentation #8035: transform/luaxform: documentation states it supports init function Actions
JF Documentation #8113: doc: remove mention of suricata-7 in latest docs Actions
JL Documentation #8135: luaxform: options incorrectly described Actions
AI Documentation #8137: windivert: Add WinDivert to Windows build instructions Actions
AD Documentation #8261: doc/userguide: fix within-distance pointer graphics in payload-keywords doc Actions
VJ Documentation #8330: doc: explain dcerpc.opnum doesn't support operators >,<,!,= Actions
LS Documentation #8344: doc: update Rust install instructions Actions
GL Documentation #8347: eve-log: modbus not listed in suricata.yaml Actions
PA Documentation #8372: rules: fix typos/ missing keywords in rule examples Actions
OD Documentation #8515: firewall: indicate to which app-layer state an app-proto keyword pertains Actions
AD Documentation #8563: doc: improve manpage of suricatasc Actions
OD Documentation #8578: doc: dcerpc any_frag option should mention which PDU is checked Actions
OD Documentation #8738: config: document support for dotted configuration keys in YAML Actions
VJ Security #8021: eve/alert: heap buffer overflow on verdict Actions
VJ Security #8065: lua: stack overflow from unbounded stack allocation in LuaPushStringBuffer Actions
VJ Security #8278: krb5: TCP parser never advances past the first record in a multi-record segment Actions
PA Security #8413: websocket: injected control frames can lead to evasion Actions
PA Security #8415: ikev2: OOM due to unbounded client_transforms Actions
PA Security #8600: windows: unquoted LocalSystem service ImagePath Actions
PA Security #8624: datasets: NULL dereference on unexpected ndjson files Actions
PA Security #8642: detect/file_data: heap buffer overflow in SWF decompression depth handling Actions
CT Security #8682: unix-socket: TOCTOU race in Unix socket directory creation Actions

9.0.0

open

Due in about 12 months (07/01/2027)

12%

12 issues   (1 closed — 11 open)

Related issues
OD Feature #8749: smb: add rule keyword support for status matches Actions
VJ Story #7583: 9.0.0: usecase: improve firewall usecase Actions
VJ Story #7584: 9.0.0: protocols: protocol additions Actions
VJ Story #7760: 9.0.0: deployment: improve secure deployment Actions
VJ Story #7761: 9.0.0: protocols: C to Rust conversions Actions
VJ Story #7900: 9.0.0: rules: improve rule language Actions
VJ Story #7901: 9.0.0: rules: improve rules keyword/output parity Actions
VJ Story #8098: 9.0.0: libsuricata Actions

Packaging/PPA

open

77%

36 issues   (28 closed — 8 open)

Related issues
PM Feature #695: Ubuntu PPA Doesn't Install Any Rules Actions
CT Feature #699: packaging for Mac Actions
PM Feature #734: Ubuntu PPA should be compiled with unix socket support enabled Actions
PM Feature #905: PPA packaging - log directories check Actions
CT Feature #949: SUSE automatic package building system Actions
CT Feature #1216: Debian repository Actions
PM Feature #1822: Support for hiredis in Ubuntu PPA Actions
PM Feature #2150: Support for attaching Suricata to multiple NFQ's using the default startup script Actions
PM Feature #2773: add suricata-update to MSI packaging Actions
PM Feature #4222: Add PPA pkg build checks to qa runs Actions
PM Feature #4445: Switch to systemd in PPA packages Actions
PM Feature #8351: windows: enable libmagic support Actions

QA

open

70%

114 issues   (80 closed — 34 open)

Related issues
OD Feature #966: scan-build support in the buildbot Actions
VJ Feature #1553: AppVeyor - TravisCI for Windows builds Actions
JI Feature #1963: travis-ci: OS X support Actions
SB Feature #2923: suricata-verify: eve2test util Actions
Feature #3082: suricata-verify: option to test 'skipped' tests Actions
TJ Feature #3357: suricata-verify: parallel tests capability Actions
PA Feature #3464: suricata-verify: Add unix-socket support Actions
CT Feature #3975: Suricata-Verify: Add JSON schema validation to EVE output. Actions
AD Feature #4059: createst: Commandline param to specify Suricata version Actions
TJ Feature #4060: createst: Commandline param to specify minimum required version of Suricata Actions
HK Feature #4061: createst: Commandline param to specify required features Actions
CT Feature #4062: createst: Allow to exclude certain fields Actions
PA Feature #4185: "requires" should be allowed to be defined per check and not just globally Actions
CT Feature #4203: createst: ability to create diff between a PR and master Actions
CT Feature #4268: createst: allow to add options with --set Actions
SB Feature #5262: run.py: should tell which fields are mismatching Actions
SB Feature #5630: SV: allow version controls for shell checks Actions
OD Feature #6112: suricata-verify: add a "fail: true" check for tests expected to fail Actions
OD Feature #6653: createst: dedup pcap used if it is from existing test Actions
OD Feature #7139: createst: identify pcap path from existing SV test Actions
OD Feature #7156: createst: automatically add --simulate-ips commandline argument Actions
OD Feature #7413: suricata-verify: allow a timeout setting in test.yaml Actions
OD Feature #7695: runner: add check for empty objects (schema) Actions
OD Documentation #5878: Suricata-verify: add a section on how to contribute to it Actions
JF Documentation #7039: suricata-verify: explain how to automatically add --simulate-ips argument Actions
OD Documentation #7077: docs: script to check whether containers exist in css styles Actions

TBD

open

To be determined -- place holder for tickets that are not prioritized/scheduled yet

25%

1124 issues   (278 closed — 846 open)

Related issues
CT Feature #121: Alert on domain name look up, capture traffic for corresponding IP Actions
CT Feature #249: Configure host-os-policy from a file, like snorts host_attribute.xml Actions
CT Feature #266: log http raw request for network forensic Actions
CT Feature #273: IRC protocol detection support Actions
CT Feature #276: Libcap support for dropping privileges Actions
CT Feature #294: Limit inspection of a stream and/or rule... Actions
JL Feature #328: Traceability and QA with regards to rules loaded Actions
CT Feature #365: expose interface(unix socket command) to reset tcp connection Actions
CT Feature #385: Configuration option to log all known (pcap) data for a stream when an alert fires Actions
CT Feature #425: Inspect the effects of mixing threshold and detection filters etc.. Actions
CT Feature #432: PCAP-NG support Actions
CT Feature #448: dlp: md5sum based on part of files Actions
VJ Feature #465: benchmark runmode Actions
CT Feature #473: pcap log: alert log with packet indexes Actions
CT Feature #511: Port indepedent protocol identification (nDPI) Actions
CT Feature #535: new keywords - time , day Actions
CT Feature #544: Live traffic decryption Actions
CT Feature #547: libinjection -- sqli library Actions
CT Feature #584: lua: expose file buffers Actions
CT Feature #596: rule profiling: multiple outputs per run Actions
CT Feature #609: Active Response in inline mode (like react in snort 2.9+) Actions
CT Feature #659: Update IP reputation from unix socket. Actions
CT Feature #716: configurable packet_stats.csv and packet_stats.log Actions
CT Feature #728: Add support for OpenCL Actions
CT Feature #745: Tunnel configuration Actions
OD Feature #776: rules: Add smtp_envelope and smtp_header keywords Actions
OD Feature #783: LuaJIT be able to return various messages for a single script. Actions
VJ Feature #816: TCP SACK: limits per stream Actions
CT Feature #821: conditional logging: output steering Actions
CT Feature #843: Custom http logging filter functionality Actions
OD Feature #870: luajit: global vars Actions
OD Feature #880: memcap http parser Actions
CT Feature #902: VLAN host table support Actions
CT Feature #933: add a IPv6 ( RFC2460 recommended order of EH )rule to decoder events rules Actions
CT Feature #936: support tzsp protocol Actions
CT Feature #960: persistent TCP resets Actions
CT Feature #1002: Possible to disabling/bypassing a rule by a specific source ip and a destination ip? Actions
OD Feature #1015: add chained content info to rule analysis Actions
OD Feature #1025: seperate #ifdef UNITTEST code into their own files Actions
CT Feature #1095: Integration of support for STIX-based indicators Actions
OD Feature #1132: set rpath for libs not in the default linker paths Actions
OD Feature #1140: IP-Address white list implementation for IPS mode (without disable a rule global) Actions
CT Feature #1191: EVE log does not support customformat Actions
CT Feature #1194: Implement http_args keyword to match http arguments - query string or body Actions
CT Feature #1215: journald logging support Actions
CT Feature #1234: nfqueue: use mnl API Actions
OD Feature #1239: Best effort TCP stack Actions
CT Feature #1245: Add "drop-only" and "alert-only" option for pcap-log Actions
CT Feature #1247: Using suppress in threshold.config does not prevent dropping Actions
OD Feature #1250: protocol: Multipath TCP (mptcp) Actions
CT Feature #1290: handle SIGHUP signal Actions
OD Feature #1300: profiling: per flow recording of profiling data Actions
CT Feature #1323: automated eve.json rotation Actions
PM Feature #1348: OOBE -6- increasing max-pending-packets default value Actions
CT Feature #1370: sctp: fp on suricata engine Actions
OD Feature #1380: JSON and Unified2 output "payload" does not contain full (or real in the case of Unified2) packets for session Actions
OD Feature #1389: suppress by host Actions
OD Feature #1469: Use ISO 8601 date/time formats Actions
CT Feature #1489: Log a message when memcap limit is reached Actions
OD Feature #1504: lua: better notification in verbose mode on script errors Actions
OD Feature #1505: lua: show lua scripts during rule (re)loading Actions
CT Feature #1541: multi-detect - vlan range mapping Actions
CT Feature #1566: ICMPv4 control channel detection Actions
CT Feature #1571: Socket permissions setting in suricata.yaml Actions
CT Feature #1590: lua: force file magic and md5 lookup from script Actions
CT Feature #1608: Add option to disable JSON escape slash Actions
OD Feature #1662: Disable action / rule ordering option Actions
CT Feature #1710: unix-socket: Send output to unix socket Actions
CT Feature #1712: multitenancy: 'lite' tenants Actions
CT Feature #1741: flow: use capture methods flow hash Actions
CT Feature #1750: Set Suricata to listen to all network interfaces when using AF_PACKET Actions
CT Feature #1752: Netmap for Windows Actions
MK Feature #1766: TLS keyword expansion Actions
OD Feature #1767: Support DTLS protocol Actions
CT Feature #1783: lua: create buffers to expose L2, L3, and L4 headers Actions
CT Feature #1794: test suricata rules over unix-socket Actions
CT Feature #1799: netmap: capture drop stats Actions
CT Feature #1819: Silent installer for suricata windows Actions
AH Feature #1872: add --list-decoder-protos or similar Actions
CT Feature #1899: Detecting Malicious TCP Network Flows Based on Benford’s Law Actions
OD Feature #1939: Introduce packet/byte counter in stats.log/json for local bypass Actions
CT Feature #1950: allow configuration of file-store types Actions
CT Feature #1956: Add option to re-initialise Lua output scripts Actions
CT Feature #1977: get the os info from TCP HTTP fingerprint Actions
CT Feature #1995: fast.log should show if packet has been dropped or rejected Actions
CT Feature #2021: doc: sha256 filesum extraction missing in documentation Actions
OD Feature #2055: Optionally logging on files.json - Not log every file, only certain files that are stored and extracted Actions
OD Feature #2092: Improved support for xbits/hostbits - workers runmode Actions
CT Feature #2107: eve: rotate log output based on size Actions
OD Feature #2115: Changing interfaces Actions
OD Feature #2145: Relate directly flowid with certificate file Actions
FD Feature #2147: fileinfo: sha1 hash not logged if state == TRUNCATED Actions
OD Feature #2166: output: log only triggering buffers Actions
CT Feature #2174: Need a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET Actions
OD Feature #2213: file matching: allow generic file matching / store Actions
CT Feature #2227: more detailed output about number of threads created Actions
OD Feature #2232: Allow Large value in suricata.yaml file Actions
OD Feature #2233: Allow log for payload and packet only for defined sid Actions
CT Feature #2262: Unix Socket Output Configurable Retries and Blocking Actions
CT Feature #2269: tls: tls.version: allow negation or comparison Actions
CT Feature #2273: engine analysis: enable analysis by default during startup Actions
EL Feature #2277: netinfo: structured information about the network. Output hierarchical network tree in events Actions
VJ Feature #2281: tcp stream: simpler IDS handling of overlap evasions Actions
JI Feature #2291: traffic-id: ruleset for traffic classification and bypass Actions
JI Feature #2301: netflow: dump records at interval Actions
TM Feature #2308: threshold/suppress by http_host Actions
CT Feature #2310: lua: expose xbits Actions
Feature #2316: global memcap Actions
CT Feature #2342: Write PCAP files directly to Unix Socket Actions
OD Feature #2343: Add "flush" command to unix socket Actions
OD Feature #2371: lua: list all available /exposed fields to lua Actions
OD Feature #2380: [discussion] deprecate: 'alert syslog' output Actions
CT Feature #2409: Push signatures without reloading the entire set. Actions
CT Feature #2410: Create a reset counter and track maximum number of parallel flows Actions
CT Feature #2426: tls: extend logging Actions
OD Feature #2488: HTML Parsing / Buffers Actions
CT Feature #2513: sslproxy: handle HTTP header Actions
CT Feature #2519: XFF iprep support Actions
CT Feature #2538: dsize keyword improvements Actions
CT Feature #2569: multi-tenancy: allow mapping to 'device pair' in IPS mode Actions
CT Feature #2613: stats: add xdp counters to stats Actions
DJ Feature #2628: Specify the flow direction in metadata sent by Suricata. Actions
CT Feature #2648: store captured data into file Actions
CT Feature #2661: output the http-body-data to eve.json Actions
CT Feature #2672: Split out DHCP parser to be reusable Actions
CT Feature #2673: Split out DNS parser to be reusable Actions
CT Feature #2674: Split out NFS parser to be reusable Actions
EP Feature #2675: Split out SMB parser to be reusable Actions
OD Feature #2681: Reloading of categories file, IP reputation list during rule live reload Actions
PC Feature #2700: ja3/ja3s functionality for IKEv2 Actions
CT Feature #2701: flow: counter for allocations at runtime Actions
PC Feature #2713: protocol detection w/o protocol parsing Actions
BT Feature #2746: Use Available Instruction Set Specialization (AVX2 and AVX512) in Hyperscan when available Actions
OD Feature #2755: vendor id / vid keyword to give rulesets unique sid ranges Actions
OD Feature #2756: rules: input in json format Actions
CT Feature #2759: iprep: more granularity Actions
OD Feature #2764: dns logging v1 vs v2 Actions
CT Feature #2767: Interception of network stack attacks Actions
WV Feature #2771: MPLS over Vlan support Actions
CT Feature #2772: Add MPLS labels to alert output Actions
CT Feature #2818: Napatech Bypass support Actions
CT Feature #2858: app-layer-protocol:failed; doesn't match traffic with ALPROTO_UNKNOWN Actions
PC Feature #2860: Suricata doesn't detect part of IKEv2 traffic Actions
JL Feature #2871: lua: Exposing byte extract to script Actions
CT Feature #2925: Support for SPB encapsulation Actions
ER Feature #2931: Perform privdrop without libcap-ng support Actions
CT Feature #2932: add batman-adv decode support Actions
CT Feature #2935: Support for multiple-logger for drop eve-log Actions
MV Feature #2939: Suricata enhancements - proposals Actions
MV Feature #2957: Suricata x Moloch - protocol detection. Proposals for TLS/SSL Actions
MV Feature #2962: eve: log more IKEv2 fields Actions
CT Feature #2987: Suggestions for new keywords (streambits) Actions
AH Feature #2996: Extend decode events and rules Actions
OD Feature #3042: stats: allow per second stats updates Actions
SS Feature #3105: Add kafka output Actions
CT Feature #3212: Prevent duplicate pcaps from being re-processed Actions
CT Feature #3244: IMAP Support Actions
CT Feature #3245: Email extraction to separate folder Actions
CT Feature #3246: Logging of Email body Actions
OD Feature #3260: SMTP Base64 Decoding of Message Body Actions
OD Feature #3261: SMTP quoted-printable Decoding of Message Body Actions
OD Feature #3271: Add keyword to determine flow based speed/bw Actions
OD Feature #3290: use config vars everywhere Actions
CT Feature #3295: unix-socket: support to receive flow bypass information Actions
CT Feature #3296: Include in the fileinfo if it was a duplicate Actions
JI Feature #3298: Create a config flag in the DNS logger to limit events to only the ones in the custom field Actions
CT Feature #3310: ease suricata configuration with xdp Actions
OD Feature #3311: Add better default suricata configuration for different traffic sizes and cpu/system architectures Actions
CT Feature #3316: unix-socket: support dumping flow table Actions
JI Feature #3317: rules: use rust for tokenizing rules Actions
OD Feature #3319: on 'wrong thread' reinject packets to correct thread Actions
CT Feature #3321: Evaluate different encoders for eve-log Actions
JI Feature #3333: Research: Unwind panic's from Rust modules Actions
PM Feature #3373: add init service file example script for Debian/Ubuntu Actions
GL Feature #3383: nflog: use mnl api Actions
OD Feature #3439: bpf-filter does not accept path/file Actions
CT Feature #3454: Add support to communicate with other networking products Actions
OD Feature #3494: rules: Keyword for determining if the http_host is an ip address Actions
OD Feature #3503: decoders: handle trailing data Actions
TN Feature #3548: Support GTP(GPRS Tunnelling Protocol). Actions
SD Feature #3554: modbus: support GAP recovery Actions
OD Feature #3555: DNP3: support GAP recovery Actions
OD Feature #3556: dns: improve GAP recovery Actions
OD Feature #3557: ftp: support GAP recovery Actions
OD Feature #3558: smtp: support GAP recovery Actions
OD Feature #3560: ssl/tls: support GAP recovery Actions
OD Feature #3561: krb5: support GAP recovery Actions
OD Feature #3562: rdp: support GAP recovery Actions
OD Feature #3563: rfb: support GAP recovery Actions
JI Feature #3629: Publish the Suricata support Python libraries to PyPI (make pip installable) Actions
CT Feature #3663: DNS: Parse and extract DNS NULL records Actions
VM Feature #3675: Testimony support Actions
JW Feature #3688: Re-implement fast_pattern:only; in some way Actions
CT Feature #3845: Threshold Hit Counter (for SID/IP) Actions
CT Feature #3848: Keep a Reference to Matched Items in Suricata Datasets for Rule-Writing Actions
RF Feature #3852: Ability to build with sanitizers Actions
CT Feature #3875: Support multiple XFF Actions
CT Feature #3894: Option "ttl" exclusive range behavior is non-intuitive Actions
CT Feature #3950: Suricata bash completion Actions
OD Feature #3954: Optimize handling of encapsulation in cloud deployment Actions
CT Feature #3959: Python tool to take ip rules and convert into iprep rule(s) Actions
CT Feature #3960: Python tool to simulate GAP testing Actions
CT Feature #4070: capture plugins: receive notification when suricata is done with a packet Actions
OD Feature #4093: Extend stats log to print packet and byte rate on protocols Actions
OD Feature #4138: A stable flow ID for dump/restore of state as well as state synchronization Actions
CT Feature #4147: Map rules to MITRE ATT&CK Actions
CT Feature #4148: Research: SSH Support for additional protocol analysis Actions
CT Feature #4149: Research: Dynamic datasets Actions
CT Feature #4150: Profiling mode: Ticks used to generate an alert available? Actions
CT Feature #4159: Log flow age as fractional value Actions
JL Feature #4162: rules: entropy rule keyword Actions
OD Feature #4172: Split eve.json into multiple files based on alert severity Actions
CT Feature #4175: dcerpc: higher level logging Actions
CT Feature #4179: tunnel-Node for flow, netflow and dns-events in eve.json Actions
OD Feature #4213: smb: higher level logging Actions
CT Feature #4217: not complete cmd start line does not produce expliccit enough warning or msg Actions
OD Feature #4227: breakout components of tls.cert_subject and tls.cert_issuer into additional "sub" buffers Actions
OD Feature #4242: config: support predefined default configuration profiles Actions
SD Feature #4249: ics protocol: SS7 Protocol Support Actions
SD Feature #4250: Diameter Protocol Support Actions
CT Feature #4270: load rules from database Actions
JW Feature #4279: Optionally allow hashing truncated files, and a maximum length to hash Actions
CT Feature #4325: xdp compile warnings on 5.4 kernels Actions
CT Feature #4333: Include the ‘short name’ from classification.config in the all-eve.log Actions
CT Feature #4381: flowbits: warn if flowbit dependencies don't follow suricata inspection order Actions
CT Feature #4398: support regex match and flowvars as keywords value Actions
OD Feature #4408: definitive log count mode for qa purposes Actions
CT Feature #4547: pcrexform not support tcp and other protocol Actions
CT Feature #4559: Tags for rules that enables mapping to Mitre Att&ck Actions
JL Feature #4573: add IPS drop total to eve log output Actions
OD Feature #4617: Add ThreatFox (by Abuse.ch) to suricata ruleset index Actions
CT Feature #4649: Autonomous System Number (ASN) support similar to GeoIP Actions
CT Feature #4758: dns: weird query should have app-layer-event? Actions
CT Feature #4770: eve: specialized output for ML on packet sizes and similar properties Actions
OD Feature #4774: rules: analysis output that shows rules per 'progress' value Actions
OD Feature #4781: config: add command to dump built-in config defaults Actions
OD Feature #4840: stats: distinguish between observational stats and performance stats Actions
CT Feature #4845: IPv6 evasion : parasite6 + dos new ipv6 + fake mldrouter6 advertise Actions
CT Feature #4951: decode: datalink type 276 not yet supported Actions
OD Feature #4976: frames: implement/complete profiling support Actions
OD Feature #4982: frames: selective frame logging Actions
PA Feature #4985: quic: support frames Actions
OD Feature #4988: frames: logging improvements Actions
OD Feature #4989: eve/alert: make frame logging configurable Actions
OD Feature #5014: Enable suricatasc to use configured command socket by default Actions
OD Feature #5051: output/frames: allow tx logging to reference frames Actions
EP Feature #5067: smb/dcerpc: Match dcerpc (over smb) requests before bind_ack Actions
OD Feature #5069: smb: keyword for matching smb command Actions
JL Feature #5128: Light weight packet profiling Actions
OD Feature #5152: Anomaly: CredSSP support addition to Suricata anomaly parsing Actions
OD Feature #5206: Buffer Dump Utility Actions
CT Feature #5209: Add "status" mode to Suricata's socket command interface Actions
OD Feature #5247: Applayer Detect protocol only one direction : RTSP protocol Actions
OD Feature #5365: Limit rust 'filetracker' memory in configuration Actions
SP Feature #5372: Add support for encrypted traffic analysis Actions
OD Feature #5405: Make suricata point to where to report a bug Actions
OD Feature #5440: multiple stats EVE logs with different intervals Actions
OD Feature #5450: Rule keyword for non midstream flows Actions
OD Feature #5461: eve: Use threaded output by default Actions
OD Feature #5469: rules: expose per flow stream.midstream setting to the rule language Actions
OD Feature #5470: reject: allow reject dev to be specified in the yaml Actions
MM Feature #5499: PCAP-over-IP client Actions
OD Feature #5618: setup-app-layer: add option to choose TCP/UDP protocol Actions
OD Feature #5641: dns: frame based keywords for "raw" fields in requests and responses Actions
OD Feature #5648: flowworker: heuristic to see how busy a thread is with elephant flows Actions
OD Feature #5649: eve.flow: add thread id(s) processing a flow to the record Actions
OD Feature #5650: unix socket: query threads about most recent elephant flows Actions
OD Feature #5655: host: make memuse and memcap reached counters for host table Actions
OD Feature #5657: byte_test: allow comparison with static value Actions
OD Feature #5668: eve: optionally add rule fast_pattern Actions
CT Feature #5670: Support wide strings somehow Actions
OD Feature #5673: capture: option to decapsulate everything first Actions
OD Feature #5674: Support layered protocols Actions
CT Feature #5675: protocol: MMS SCADA support Actions
OD Feature #5676: ASN1 Spec to Rust nom generator Actions
OD Feature #5677: protocol: BGP support Actions
CT Feature #5681: datasets: add more transform layers to match on domains Actions
OD Feature #5687: eve: "auth" and/or "auth_fail" log Actions
PC Feature #5705: protocol: Wireguard parser Actions
OD Feature #5716: rdp: add app-layer frame support Actions
OD Feature #5727: krb: add frame support Actions
OD Feature #5728: modbus: add frame support Actions
OD Feature #5729: bittorrent-dht: add frame support Actions
OD Feature #5730: dhcp: add frame support Actions
OD Feature #5732: ntp: add frame support Actions
OD Feature #5733: snmp: add frame support Actions
CT Feature #5737: smtp body extract Actions
OD Feature #5745: exceptions: allow setting via unix-socket Actions
OD Feature #5752: Proposed new DNP3 keywords and operators Actions
JI Feature #5764: logging: add a format string for a more standard log format Actions
OD Feature #5774: Addressing Mixed Case in HTTP Headers Names and HTTP2 Actions
CT Feature #5776: PCRE fast_patterns via hyperscan Actions
DS Feature #5798: New transformation: dropbytes Actions
CT Feature #5872: file structure awareness - precise identification of fields in file structs Actions
VJ Feature #5894: file: file classification keyword Actions
CT Feature #5913: rfb: add more record types Actions
OD Feature #5956: Report traffic with missing VLAN tag Actions
OD Feature #6004: Add retry option to redis outputs using a socket instead of IP Actions
OD Feature #6051: app-layer: dhcpv6 support Actions
OD Feature #6067: Add field to track SID of Flowbit Matches Actions
OD Feature #6101: icap: app-layer protocol support Actions
OD Feature #6102: Translate NAT64 ranges (also custom ranges) Actions
AH Feature #6161: file-store: missing hash on TRUNCATED files Actions
OD Feature #6198: smtp: add keywords for use in rules Actions
CT Feature #6200: output: suricata.yaml dump-all-headers applied for alerts Actions
CT Feature #6206: Investigate a more intuitive use of the timestamp field in traffic/metadata events Actions
JR Feature #6251: AF-XDP ability to bind custom program Actions
VJ Feature #6268: Recognize related ICMP request/response pairs Actions
EL Feature #6295: output: add stream-size to flow output Actions
OD Feature #6296: smtp: BDAT chunking support incl MIME parsing Actions
CT Feature #6350: detect/analyzer: add more details for the tcp.flags keyword Actions
CT Feature #6356: detect/analyzer: add more details for the tcp.hdr keyword Actions
CT Feature #6358: detect/analyzer: add more details for the ICMP itype keyword Actions
OD Feature #6373: main/startup: support sentinel file signal for initial rule processing completion Actions
CT Feature #6410: Log packets/bytes per second in Suricata stats Actions
OD Feature #6453: Support DNS over TLS Actions
OD Feature #6456: output: binary logging Actions
OD Feature #6457: eve: configurable list of fields in output Actions
GL Feature #6461: ics protocol: bacnet Actions
CT Feature #6462: ics protocol: IEC104 Protocol Support Actions
CT Feature #6464: protocol: profibus Actions
OD Feature #6465: multi-tenant: support vxlan as a selector Actions
OD Feature #6466: multi-tenant: support mpls as a selector Actions
OD Feature #6467: flow tracking: add other parameters to flow tracking Actions
OD Feature #6468: flow-tracking: add geneve as a flow tracking parameter Actions
OD Feature #6469: flow-tracking: add erspan as a flow tracking parameter Actions
OD Feature #6470: flow-tracking: add vxlan as a flow tracking parameter Actions
OD Feature #6471: flow-tracking: add mpls as a tracking parameter Actions
OD Feature #6482: Deployment: detect if capture is good enough Actions
OD Feature #6625: Apply netflow per network Actions
OD Feature #6649: Add a keyword to match on raw data within headers especially for protocols without a dedicated parser Actions
OD Feature #6650: dns: support extended response/error codes Actions
OD Feature #6683: stats: add packet time elapsed indicator Actions
EL Feature #6692: Have keywords export JSON dump function for engine analysis Actions
OD Feature #6701: Auto-bypass optimization Actions
OD Feature #6779: http.header_names behavior when encountering duplicate header names Actions
SJ Feature #6794: Tie signature to live device in IPS mode Actions
OD Feature #6802: Support Domain rollup using existing dataset library Actions
OD Feature #6807: Support the use of variables within transforms Actions
OD Feature #6808: Quantify how a Suricata rule matches against a PCAP Actions
OD Feature #6823: SC_WARN_POOR_RULE on to_lowercase/to_uppercase transformation with non-possible matching content Actions
OD Feature #6853: Support of variables from byte_math / byte_extract in bsize / dsize comparisons Actions
OD Feature #6885: references: new "wayback" reference and update others Actions
OD Feature #6914: support inspecting http.uri or http.request_body Actions
OD Feature #6916: decoding : add support of IEEE 802.2, 802.3 frames Actions
OD Feature #6922: Have a way to manually request decompression/inflate if headers are not present Actions
OD Feature #6925: multi-buffer support for HTTP cookies Actions
OD Feature #6926: rules: new buffer that includes HTTP headers and the start of HTTP body Actions
OD Feature #6993: rule macros for commonly used logic in rules Actions
OD Feature #6995: raw option for http.request/response_header Actions
OD Feature #7052: Add facility to move data from code into data files Actions
OD Feature #7056: version info not reported in stats json Actions
OD Feature #7057: monitored interface information in stats json Actions
SS Feature #7082: redis: support EVE output to a Redis stream Actions
OD Feature #7095: rdp: keywords additions Actions
OD Feature #7096: detect/flow: additions to time detection Actions
OD Feature #7097: Additions to flow detection - size Actions
OD Feature #7099: Addition of total bytes to the flow logs Actions
OD Feature #7100: smb: additional keywords Actions
PM Feature #7101: eve: add number of flowbits in protocol records and alerts Actions
OD Feature #7103: ssh: extra fields and keywords Actions
OD Feature #7127: extended http.referer buffers/keywords Actions
JL Feature #7129: decode: Create a decode event for unknown ethertypes Actions
OD Feature #7132: threshold: add thresholding options for all decode events Actions
JL Feature #7146: decode: Create a decode event for unknown IP types Actions
BB Feature #7175: Response module API Actions
OD Feature #7221: Sanity checking on IP network prefix base addresses Actions
CT Feature #7283: installing suricatasc functionality without installing suricata entirely Actions
OD Feature #7321: rules: cross buffer byte_* keyword support Actions
OD Feature #7328: detect: use hyper scan streaming mode Actions
AM Feature #7364: deciphering https traffic from linux system Actions
OD Feature #7384: vlan: flowID should take MPLS into consideration Actions
OD Feature #7400: eve: optionally support logging pcap output file Actions
OD Feature #7402: tls: ability to detect self signed certs Actions
OD Feature #7446: add logic to parse QUIC CRYPTO frames and provide a keyword to access the reassembled data Actions
OD Feature #7518: add "blocking" argument to pcap-file socket command Actions
OD Feature #7535: detect/ldap: add ldap.search_request.filter and also log the filter Actions
OD Feature #7550: detect/ldap: add keywords for LDAP ExtendedResponse Actions
OD Feature #7559: Allow rule comment at end of rule line using # Actions
OD Feature #7572: Relative offset support for the entropy keyword Actions
OD Feature #7594: mime: add email.status keyword Actions
OD Feature #7621: rules: add lua extension or function Actions
OD Feature #7654: detect: rule keywords for matching on file hashes Actions
OD Feature #7655: Allow using flow id in pcap log file name Actions
OD Feature #7675: Custom content detection Actions
JL Feature #7679: output/log: log the entropy value Actions
OD Feature #7696: output: configuration for simple loggers, and reuse in alerts Actions
VJ Feature #7697: firewall: allow request/response action scopes Actions
VJ Feature #7700: firewall: make verdict fields in alert and drop mandatory Actions
VJ Feature #7706: firewall: default settings; locked settings Actions
OD Feature #7729: Ability to use local fqdns (to get ipv4 and/or ipv6) in address-groups vars Actions
OD Feature #7756: windows: add support to reload rules Actions
OD Feature #7757: windows: add support for log rotation Actions
OD Feature #7785: pcap-log: support packet context for conditional alerts Actions
OD Feature #7796: Support for TLS decryption in pcap mode using sslkeylog file Actions
OD Feature #7844: websocket: add option to log payloads in Eve websocket events Actions
PM Feature #7882: icmp malware channel activity events in one sided flows Actions
EL Feature #7888: eve: add app_proto to all event_type Actions
OD Feature #7895: Identify tunnel parent flow ID in flow logs Actions
OD Feature #7896: Report stream/socket bytes transferred in flow logs Actions
OD Feature #7949: affinity: evaluate verbal and relative definition of CPU sets Actions
OD Feature #7951: (Feature Request) Ability to reference content matches across buffers. Actions
OD Feature #7970: tls: Log elliptic curve ID Actions
OD Feature #7971: tls: log state history Actions
OD Feature #8019: mpm: support `endswith` condition to the fast pattern in hyperscan Actions
OD Feature #8124: datasets: support subnets Actions
Feature #8132: Add decompression support to pcap-file capture method Actions
Feature #8133: Relative pcre with negative distance to previous content match Actions
VJ Feature #8221: http: header handling should treat duplicates as multi-buffer, not concat Actions
AB Feature #8245: Add payload-only-classtypes filter for EVE alert payload extraction Actions
Feature #8246: af-packet: allow specifying IPS mode on the commandline Actions
Feature #8277: rules: add negation support for ipopts keyword Actions
Feature #8319: Add threaded output socket support for unix_dgram Actions
GT Feature #8329: Implement ERSPAN type 3 Actions
SS Feature #8427: Feature request: support glob patterns in include directive Actions
Feature #8428: Include GENEVE tunnel options in EVE JSON logs Actions
Feature #8436: rules: allow rule to modify midstream behavior per flow Actions
Feature #8470: detect/transform: Create anomaly log on transform failure Actions
OD Feature #8479: eve/firewall: dedicated log record type Actions
CT Feature #8517: ikev2: new buffers and keywords Actions
KS Feature #8593: ndpi: adding the "category" keyword for the ndpi pluggin Actions
JL Feature #8671: detect/transforms: support inline variable-key extraction (var <nbytes> <offset>) Actions
Feature #8680: ftp: discover server side filename for STOU file transfers Actions
OD Feature #8691: detect: SNMP Varbind Keywords Actions
OD Feature #8693: detect: smtp/email body and header inspection keywords Actions
OD Feature #8748: detect: rule keyword to match on unregistered ip protocol payload Actions
AH Documentation #595: document csum keywords Actions
AH Documentation #1233: Documentation for each keyword in stats.log file. Actions
PM Documentation #1691: Docs: Convert windows docs Actions
CT Documentation #1892: rule docs should include example rules Actions
CT Documentation #1974: DNP3: document lua support Actions
OD Documentation #2016: doc: improve keywords self documentation Actions
CT Documentation #2266: no documentation for file-store-waldo Actions
PM Documentation #2404: Windows Installation Guide for Suricata bug Actions
EU Documentation #2470: document content inspection in chunks Actions
OD Documentation #2585: document replace keyword Actions
OD Documentation #2588: document hostbits keyword Actions
CT Documentation #2589: document decode-event Actions
SS Documentation #2699: document all eve record types and fields Actions
CT Documentation #2918: Unable to mmap, error Resource temporarily unavailable - err seems OS specific Actions
CT Documentation #2976: review userguide from beginners point of view Actions
OD Documentation #3018: No documentation for "flowvar" keyword Actions
OD Documentation #3019: No documentation for "pktvar" keyword Actions
OD Documentation #3022: No documentation for "nfq_set_mark" keyword Actions
JT Documentation #3023: No documentation for "bsize" keyword Actions
JT Documentation #3025: Missing docs for "http." keywords Actions
OD Documentation #3027: No documentation for "nfs" keywords Actions
OD Documentation #3031: No documentation for "asn1" keyword Actions
OD Documentation #3032: No documentation for "engine-event" keyword Actions
OD Documentation #3033: document: "stream-event" keyword Actions
OD Documentation #3034: No documentation for "l3_proto" keyword Actions
OD Documentation #3035: No docs for "base64_" keywords Actions
OD Documentation #3036: No documentation for "template2" keyword Actions
AH Documentation #3046: Document each default value from the config file Actions
OD Documentation #3180: tracking: document all decoder and app-layer events Actions
OD Documentation #3181: document http engine events Actions
CT Documentation #3222: userguide: improve guidance on ipv6 configuration Actions
AH Documentation #3268: Add links to additional information at the wiki to the userguide Actions
JT Documentation #3274: doc: some inconsistency between http docs keywords description Actions
OD Documentation #3303: Add a documentation about the used sid and gid ranges Actions
PM Documentation #3313: Document 40Gbps IPS set up Actions
CT Documentation #3748: Add documentation for flags keyword Actions
CT Documentation #3751: Alert metadata JSON configs in suricata.yaml.in should match the RTD documentation Actions
CT Documentation #3762: update documentation for user modes Actions
CT Documentation #4662: Add documentation section covering Suricata rule grammar Actions
CT Documentation #4706: Guide for rulewriting Actions
CT Documentation #4743: Improve Suricata code documentation (C files) Actions
SS Documentation #4768: DNS v2 EVE does not longer contain `dns.rdata` but it is still listed in the documentation Actions
CT Documentation #5068: nfs: document rule keyword Actions
OD Documentation #5182: userguide: better document rule keywords Actions
JF Documentation #5225: testing/fuzz: improve documentation on how to fuzz suricata Actions
OD Documentation #5359: userguide: improve documentation on (main) EVE fields Actions
OD Documentation #5367: byte_test: all examples in doc missing a required argument Actions
OD Documentation #5484: userguide: explain content modifiers usage with regards to position usage in the rule Actions
OD Documentation #5487: userguide: add explanation on how depth of inspection affects rules Actions
OD Documentation #5514: userguide: document exception policy from an extreme profiling and tuning perspective Actions
OD Documentation #5523: userguide: document the tcp-stream keyword Actions
OD Documentation #5537: devguide: add section/chapter about how [capture] bypassing works for Suricata Actions
CT Documentation #5591: devguide: bring section about OpenBSD Installation from git into devguide Actions
AH Documentation #5620: doc: add vectorscan instructions Actions
OD Documentation #5660: userguide: add (more) documentation for the GRE protocol Actions
JT Documentation #5662: Review/Update Hyperscan Documentation Actions
OD Documentation #5669: Better link together the bits keywords Actions
OD Documentation #5724: Why does reject-dev option work only in Sniff Mode Actions
OD Documentation #5772: docs: A wrong rule matching example provided by the official doc Actions
OD Documentation #5837: Unify documentation of command-line parameters Actions
OD Documentation #5841: tracker: bring documentation from old wiki on redmine to readthedocs guides Actions
CT Documentation #5842: userguide: bring session about Suricata installation from Ubuntu PPA Actions
OD Documentation #5995: userguide: ips upgrade guide Actions
JI Documentation #6059: docs: fix build failure - urllib3 issue Actions
OD Documentation #6071: eve/schema: add descriptions to the schema Actions
VJ Documentation #6072: eve/schema: document smb Actions
JI Documentation #6073: eve/schema: document dns Actions
VJ Documentation #6074: eve/schema: document nfs Actions
JI Documentation #6077: eve/schema: document sip Actions
OD Documentation #6133: tracking: security deployment documentation Actions
AH Documentation #6150: doc: improve the file-store documentation for the eve output and the dedicated section Actions
CT Documentation #6361: userguide: add note about severity<-> priority on alert section Actions
JT Documentation #6386: Add tls.cert_chain_len Documentation Actions
OD Documentation #6404: flow.reason value is misleading? Actions
OD Documentation #6478: schema: add missing fields Actions
CT Documentation #6694: placement of bitmask note about right shift behavior Actions
JT Documentation #6924: replicate http.cookie behavior from "Differences From Snort" to http.cookie Actions
OD Documentation #6982: offset: no documentation that offset can be a name Actions
JT Documentation #6991: add note about case sensitivity to flowbits docs Actions
OD Documentation #6992: Document normalization of header name/value separator Actions
OD Documentation #7145: userguide: update legacy keyword mentions to new ones Actions
OD Documentation #7217: userguide: add config section on reading pcap-files Actions
CT Documentation #7220: guides: add a post on using 'ip' and 'tcpdump' to Suricata forum's Guides Actions
CT Documentation #7222: userguide: document decoder events Actions
OD Documentation #7223: document 'stream-event' keyword Actions
OD Documentation #7237: userguide: default's to latest development branch instead of latest release tag Actions
CT Documentation #7244: userguide: explain multi-tenant default config Actions
CT Documentation #7298: schema/netflow: add missing field Actions
CT Documentation #7299: eve/schema: document tls Actions
OD Documentation #7355: Non working signatures in filestore explanation Actions
OD Documentation #7385: userguide/redmine: have some instructions for bug reports Actions
OD Documentation #7386: userguide: list which config fields are updated w/ rule reload Actions
OD Documentation #7395: engine/analysis: document the output for user friendliness Actions
OD Documentation #7396: userguide: standardize rst formatting for chapters Actions
OD Documentation #7545: userguide: document user mode and system mode and their relation to the log directory Actions
OD Documentation #7770: json schema : extend to describe how a log field matches to a keyword in complex cases Actions
OD Documentation #7833: Complete list of commands supported by suricatasc Actions
OD Documentation #7897: doc: byte_test missing documentation for bitmask option Actions
OD Documentation #8018: datasets: a rule using "load" can use an absolute or relative filename Actions
OD Documentation #8236: byte_math: fails to list valid values Actions
OD Documentation #8283: flow: better documenation and guidance for recyclers and managers Actions
SS Documentation #8358: Wrong file path for suricata.yaml in the Quick Start guide Actions
OD Security #5851: rust: handle allocation failures Actions
OD Security #6187: detect: handle allocation failures during rule reload Actions

Suricata-Update - TBD

open

To be determined

15%

44 issues   (7 closed — 37 open)

Related issues
OD Suricata-Update - Feature #2256: Generate a report and log it to a file. Actions
JW Suricata-Update - Feature #2509: Add support to have more than one condition to match a rule Actions
PM Suricata-Update - Feature #2630: Suricata Update for Windows Actions
JS Suricata-Update - Feature #2659: Define the output rules file name. Actions
OD Suricata-Update - Feature #2938: Add a "show-defaults" command Actions
SB Suricata-Update - Feature #3202: classtypes: validate classtypes in use Actions
CT Suricata-Update - Feature #3289: option to verify 'better' standard/schema Actions
MS Suricata-Update - Feature #3721: Add iprep compatibility Actions
JI Suricata-Update - Feature #4113: intel index: register sid ranges per rule source Actions
JI Suricata-Update - Feature #4355: Easy way to disable all engine provided rules. Actions
CT Suricata-Update - Feature #4393: config: define threshold in template and output file in suricata-update config file Actions
JI Suricata-Update - Feature #4481: list-sources: list locally added sources, and make it clear they are local sources Actions
CT Suricata-Update - Feature #6131: threshold.conf: reconcile current threshold.conf with current state of rules Actions
SB Suricata-Update - Feature #6202: Resolve xbits dependencies Actions
VG Suricata-Update - Documentation #3038: documentation: Setup directories with correct permissions Actions
JI Suricata-Update - Documentation #4665: Update docs to include information about file* functionality Actions
AD Suricata-Update - Documentation #5376: Add documentation about updating referenced auxiliary files with Suricata-Update Actions
OD Suricata-Update - Documentation #7138: "Permission denied" when trying to add and update new ruleset Actions

git main

locked

No issues for this version