Project

General

Profile

Roadmap

8.0.0-beta1

open

Due in 39 days (06/04/2024)

31%

569 issues   (152 closed — 417 open)

Related issues
Feature #845: Memory consumption in stats.log Actions
Feature #1005: conditional logging: controlling what gets logged Actions
Feature #1065: Introduce vlan id keyword Actions
Feature #1199: protocol: LDAP support Actions
Feature #1520: multitenancy - verbose output clarity Actions
Feature #1542: dump-config - extend into multi-detect supplied yaml configuration Actions
Feature #1971: lua: make mandatory Actions
Feature #1993: commandline: introduce --enable-all-outputs switch Actions
Feature #2290: lua: use script as transform Actions
Feature #2375: Design and implement sensible per-thread capabilities Actions
Feature #2377: deprecate: ssh.softwareversion and ssh.protoversion Actions
Feature #2448: Add additional buffers for DNS Responses Actions
Feature #2486: prefilter/fast_pattern logic for flowbits Actions
Feature #2678: list-keywords: add info about fast_pattern and transforms Actions
Feature #2695: websocket support Actions
Feature #2696: http parser in rust Actions
Feature #2816: vlan: support more than 2 layers Actions
Feature #2958: Suricata 5.0.0beta1 and way too much anomaly logging Actions
Feature #3003: filestore to uses rename syscall instead of sendfile,which doesn't allow files to be sent across file systems Actions
Feature #3351: sip: parse traffic over tcp Actions
Feature #3446: app-layer: implement MySQL parser Actions
Feature #3487: multi-part parser in Rust Actions
Feature #3636: eve: configuration options to enable all, none or just a default set of outputs Actions
Feature #3952: mDNS protocol implementation Actions
Feature #3953: 8021BR E packet decoder Actions
Feature #3958: Convert protocol to Rust: ENIP Actions
Feature #4089: rules: Flexible format transform Actions
Feature #4099: allow rule keyword registration from app-layer Actions
Feature #4136: use Suricata-Update managed classification.config Actions
Feature #4153: Rust parsers: Make use of Rust derive style macros to generate common code in parsers Actions
Feature #4174: tracking: app-layer frame inspection support Actions
Feature #4217: not complete cmd start line does not produce expliccit enough warning or msg Actions
Feature #4226: bsize: apply as depth to patterns Actions
Feature #4566: pgsql: add subprotocol-states Actions
Feature #4660: base64_decode cannot used with Transformations like pcrexform Actions
Feature #4776: lua: vendor latest lua stable Actions
Feature #4777: lua: implement sandboxing Actions
Feature #4853: eve: Add information about Suricata version Actions
Feature #4854: pgsql: Add COPY subprotocol-state Actions
Feature #4855: rules: refactor rule parsing into multi-stage parser Actions
Feature #4861: smb: support multi-stream file transfers Actions
Feature #4876: Additional FTP Buffers Actions
Feature #4904: dcerpc: add stream app-layer records support Actions
Feature #4905: smtp: add stream app-layer frame support Actions
Feature #4906: ftp: add stream app-layer frame support Actions
Feature #4910: dpdk: implement secondary mode Actions
Feature #4946: nfsv2: implement WRITE support Actions
Feature #4986: postgresql: support frames Actions
Feature #4990: eve/frames: make payload logging configurable Actions
Feature #5029: eve: telnet logger Actions
Feature #5049: detect/frames: allow mixing with txs Actions
Feature #5075: smb: keyword for the SMB version Actions
Feature #5082: smb: keyword for matching the SMB files Actions
Feature #5194: tracking: options for simulating various exceptions Actions
Feature #5203: dpdk: implement primary app for Suricata secondary mode Actions
Feature #5217: ips: allow dropping of flow if applayer specific memcap is hit Actions
Feature #5234: SSL/TLS Sticky Buffer for subjectAltName Actions
Feature #5286: ips: allow dropping of packet/flow when alert queue exceeded Actions
Feature #5415: tftp: support keywords such as file.name, file.data etc... Actions
Feature #5446: allow ranges in dns.opcode value Actions
Feature #5466: detect: allow alert-then-pass logic Actions
Feature #5489: research: multi version rules; or version dependent rules Actions
Feature #5495: implement grace period for midstream exception policy Actions
Feature #5642: DNS: parity between log fields and detection Actions
Feature #5664: "Scope" bits should have an expiration Actions
Feature #5665: rules: bidirectional transaction matching Actions
Feature #5692: Add brotli content encoding to HTTP/1.1 Actions
Feature #5726: ike: add frame support Actions
Feature #5737: smtp body extract Actions
Feature #5773: Support DNS over HTTPS (DoH) Actions
Feature #5775: http.headers - dynamic sticky buffers Actions
Feature #5816: Exception policy stats counters Actions
Feature #5826: frames: logging of events set on frames Actions
Feature #5838: dpdk: NIC encapsulation stripping Actions
Feature #5839: dpdk: power saving mode Actions
Feature #5845: smb: Support SMB_COM_SESSION_SETUP_ANDX Request Actions
Feature #5972: rules: "requires" keyword representing the minimum version of suricata to support the rule Actions
Feature #5973: warn when HTTP rules will only work for a specific version of HTTP Actions
Feature #5974: Midstream exception policy "reject-both" support Actions
Feature #5976: eve/stats: allow hiding counters whose value is 0 Actions
Feature #6012: dpdk: add support for segmented mbufs Actions
Feature #6079: eve/dcerpc: eve/smb: log dcerpc uuid with request/response txs Actions
Feature #6114: dpdk: wrap DPDK logs in a Suricata logger Actions
Feature #6164: detect: new keyword flow.pkts_toclient to server and bytes as well Actions
Feature #6210: outputs: add verdict event type Actions
Feature #6215: Exception policy log output Actions
Feature #6237: Multi-tenancy: Allow inner VLAN to be selected Actions
Feature #6259: pgsql: add `query` detection keyword Actions
Feature #6260: Support flow matching excluding packet recursion level Actions
Feature #6261: Add GRE as a parsible protocol Actions
Feature #6290: support case insensitive testing of HTTP header name existence Actions
Feature #6293: Support disabling forced flow reuse in low memory conditions Actions
Feature #6366: pop3 protocol detection Actions
Feature #6368: stream/midstream: wscale setting Actions
Feature #6374: Sticky buffers for sip headers Actions
Feature #6379: JA4 support for TLS and QUIC Actions
Feature #6396: Add protocol string support for mqtt Actions
Feature #6399: Per-thread stats values can be negative Actions
Feature #6410: Log packets/bytes per second in Suricata stats Actions
Feature #6422: dpdk: expand on DPDK allocation hints Actions
Feature #6426: HTTP/2 - app-layer-event and normalization when userinfo is in the :authority pseudo header for the http.host header Actions
Feature #6439: New Transformation: to_lowercase Actions
Feature #6455: txbits: support for new type of bits Actions
Feature #6459: filebits: support for new type of bits Actions
Feature #6480: plugins: allow plugins to specify the version of suricata they are for Actions
Feature #6487: transform: from_base64 Actions
Feature #6496: dns: new detection buffer: dns.answer.name Actions
Feature #6497: dns: new detection buffer: dns.query.name Actions
Feature #6546: transformation - strip_pseudo_headers Actions
Feature #6550: Capability to have rules profiling on pcap run Actions
Feature #6621: dns: add keyword for dns rcode: dns.rcode Actions
Feature #6624: http/2: event on :authority vs Host header mismatch Actions
Feature #6627: SDP protocol: parser and logger Actions
Feature #6637: requires: add skipped rules to stats Actions
Feature #6644: tracking: detect: integer as first-class support Actions
Feature #6645: detect: integer parsed with hexadecimal notation Actions
Feature #6646: detect: integer: support negated ranges Actions
Feature #6647: detect: integers: support for enumerations Actions
Feature #6648: detect: integer: support bitmasks Actions
Feature #6666: dns: add keyword for dns rrtype: dns.rrtype Actions
Feature #6695: tls: log extensions Actions
Feature #6729: websockets: support over HTTP/2 Actions
Feature #6739: dpdk: warn the user if user-settings are adjusted to the device capabilities Actions
Feature #6788: Decouple stream.bypass dependency from TLS encrypted bypass Actions
Feature #6805: cpu-affinity: enhance CPU affinity logic with per-interface NUMA preferences Actions
Feature #6822: threshold: support tracking by flow Actions
Feature #6827: arp: implement decoder and logger Actions
Feature #6856: http: anomaly when request line is missing protocol Actions
Feature #6927: dpdk: add unit tests for threading and mempool cache size functions Actions
Feature #6936: landlock: enable by default Actions
Feature #6939: lua: incremement stat when a lua rule exhausts its instruction count Actions
Feature #6940: lua: handle errors in lua rules Actions
Feature #6943: pcap: datalink type 229 not (yet) supported in module PcapFile Actions
Feature #6967: multi-tenancy: support thresholding per tenant Actions
Documentation #2620: Documentation: tagged_packets / event_type packet Actions
Documentation #3015: userguide: document "tag" keyword Actions
Documentation #3748: Add documentation for flags keyword Actions
Documentation #4350: Devguide: transaction handling logic Actions
Documentation #4352: Devguide: Debugging Basics - pcap_cnt Actions
Documentation #4557: Add document about JsonBuilder Actions
Documentation #4658: Add/improve documentation for pcre substring capture logging Actions
Documentation #4705: userguide: add sections about frame support Actions
Documentation #4706: Guide for rulewriting Actions
Documentation #4708: DevGuide: Add Eve Output Plugins Actions
Documentation #4709: Add page about analyzing Suricata performance Actions
Documentation #4980: doc/frames: document frame rule keyword Actions
Documentation #5008: userguide: add a protocol chart listing defaults Actions
Documentation #5068: nfs: document rule keyword Actions
Documentation #5078: suricata config reload: improve documentation on behavior Actions
Documentation #5088: file.name sticky buffer is not documented Actions
Documentation #5138: userguide: add a section for fileinfo eve type Actions
Documentation #5139: userguide: add a section for netflow event type Actions
Documentation #5274: devguide: document how the alert flow works Actions
Documentation #5393: devguide: move github workflow document from redmine into devguide Actions
Documentation #5449: userguide: document how suricata processes rules internally Actions
Documentation #5465: doc/userguide: document terminating behavior of rule actions Actions
Documentation #5494: userguide: update tls eve-log fields 'not_before' and 'not_after' Actions
Documentation #5513: userguide: add a chapter for IPS mode Actions
Documentation #5531: userguide: ensure documentation is up to date Actions
Documentation #5532: userguide: have a section to mention and document the various ways stream-depth can be set Actions
Documentation #5534: userguide: better document what TCP midstreams are for Suricata Actions
Documentation #5543: userguide: document which keywords accept the prefilter keyword Actions
Documentation #5554: userguide: document behavior for actions like PASS, DROP, REJECT, BYPASS... Actions
Documentation #5575: docs: bring 'reporting bugs page' into userguide and update it Actions
Documentation #5612: devguide: add a chapter about Suricata's exception policies Actions
Documentation #5651: bsize: format should specify operators Actions
Documentation #5690: Document the differences between IPS and IDS mode. Actions
Documentation #5829: userguide: add context on "why/when an exception policy is applied" Actions
Documentation #5830: userguide: update & improve exception policy section Actions
Documentation #5842: userguide: bring session about Suricata installation from Ubuntu PPA Actions
Documentation #5869: userguide: describe what are the delta stats counters Actions
Documentation #5891: userguide: explain different log save directory in offline mode Actions
Documentation #5897: devguide: add section on generating code coverage reports locally Actions
Documentation #5910: devguide: explain possible differences in data inspection with inline stream or not Actions
Documentation #5911: userguide: update & bring guide for installation on Windows to RtD Actions
Documentation #6022: devguide: explain how the engine identifies applayer protocols Actions
Documentation #6026: userguide/suricata-yaml: update image on threading Actions
Documentation #6030: devguide: expand Suricata Internals chapter Actions
Documentation #6058: doc/configuration: clarify sig_id & gid_id for global threshold Actions
Documentation #6069: userguide/install: move RPM distros to their own page Actions
Documentation #6076: eve/schema: document quic Actions
Documentation #6078: eve/schema: document pgsql Actions
Documentation #6180: userguide: add troubleshooting section Actions
Documentation #6219: userguide: add page about different usecases Actions
Documentation #6252: userguide/install: move Ubuntu distros to their own page Actions
Documentation #6270: userguide: document usage of Suricata as a firewall Actions
Documentation #6284: userguide: document what's the impact of `stream.inline` Actions
Documentation #6361: userguide: add note about severity<-> priority on alert section Actions
Documentation #6369: stream: document stream.3whs_syn_flood and stream.3whs_synack_flood Actions
Documentation #6406: userguide: remove ambiguous "we" usages Actions
Documentation #6412: devguide: API upgrade notes Actions
Documentation #6434: eve/schema: document stats Actions
Documentation #6442: rtd: indicate that a page is for an outdated version Actions
Documentation #6445: userguide: explain what flow_id is Actions
Documentation #6450: userguide: add section about sshhash Actions
Documentation #6451: userguide: update 'what is suricata' section Actions
Documentation #6452: userguide/ftp: clarify usage around ftp and ftp.data keyword Actions
Documentation #6478: schema: add missing fields Actions
Documentation #6484: userguide: add keyword performance results Actions
Documentation #6486: userguide: explain pkt_on_wrong_thread counter Actions
Documentation #6492: doc: explain how FTP works Actions
Documentation #6495: userguide: add section on SMTP event type Actions
Documentation #6498: userguide/output: add section about fileinfo Actions
Documentation #6552: doc: add tcp timeout fix to upgrade guide Actions
Documentation #6566: userguide: add description for missing EVE krb fields Actions
Documentation #6568: devguide: document backports policies and process Actions
Documentation #6570: remove references in docs mentioning prehistoric Suricata versions Actions
Documentation #6589: docs: fix broken bulleted list style on rtd Actions
Documentation #6599: docs: update eBPF installation instructions Actions
Documentation #6626: devguide: add instructions for MacOS setup Actions
Documentation #6628: userguide: document generic aspects of integer keywords Actions
Documentation #6629: Fix byte_test examples Actions
Documentation #6685: userguide: explain noalert keyword Actions
Documentation #6686: docs: port userguide build instruction changes from master-6.0.x Actions
Documentation #6708: userguide/payload: fix explanation about bsize ranges Actions
Documentation #6725: document pcap file variables Actions
Documentation #6781: http keywords lacking information about values from duplicate headers being concatenated Actions
Documentation #6840: devguide/app-layer: section with conceptualized steps for adding parser Actions
Documentation #6908: userguide: document how to verify tar.gz signature Actions
Documentation #6911: manpages: use consistant date based on release and/or git commits Actions
Documentation #6955: devguide: update coding-style docs Actions
Security #5921: http1: configurable limit for maximum number of live transactions per flow Actions
Security #5926: http2: evasion by splitting header fields over frames Actions
Security #6187: DetectEngineReload: handle allocation failures Actions
Security #6299: mqtt pcap with anomalies takes too long to process because of app-layer-event detection Actions
Security #6411: pgsql: quadratic complexity leads to over consumption of memory Actions
Security #6441: detect: heap use after free with http.request_header keyword Actions
Security #6444: http1: quadratic complexity from infinite folded headers Actions
Security #6477: SMTP: quadratic complexity from unbounded number of transaction per flow Actions
Security #6481: http2: quadratic complexity in find_or_create_tx not bounded by max-tx Actions
Security #6757: libhtp: quadratic complexity checking after request line missing protocol Actions
Security #6796: output/filestore: slowdown because of running OutputTxLog on useless packets Actions
Security #6799: ssh: quadratic complexity in overlong banner Actions
Security #6866: eve: excessive ssh long banner logging Actions

8.0.0-rc1

locked

Due in about 4 months (09/03/2024)

No issues for this version

8.0.0

locked

Due in about 5 months (10/01/2024)

No issues for this version

7.0.6

open

1%

39 issues   (0 closed — 39 open)

Related issues
Feature #6063: exception-policy: stream async policy Actions
Feature #6509: Exception policy stats counters (7.0.x backport) Actions
Feature #6557: Capability to have rules profiling on pcap run (7.0.x backport) Actions
Feature #6674: detect: allow alert-then-pass logic (7.0.x backport) Actions
Feature #6681: Midstream exception policy "reject-both" support (7.0.x backport) Actions
Feature #6682: implement grace period for midstream exception policy (7.0.x backport) Actions
Documentation #6519: rtd: indicate that a page is for an outdated version (7.0.x backport) Actions
Documentation #6582: userguide: add description for missing EVE krb fields (7.0.x backport) Actions
Documentation #6601: docs: update eBPF installation instructions (7.0.x backport) Actions
Documentation #6641: doc: add tcp timeout fix to upgrade guide (7.0.x backport) Actions
Documentation #6687: docs: port userguide build instruction changes from master-6.0.x (7.0.x backport) Actions
Documentation #6836: DevGuide: Add Eve Output Plugins (7.0.x backport) Actions
Documentation #6841: devguide/app-layer: section with conceptualized steps for adding parser (7.0.x backport) Actions
Documentation #6910: userguide: document how to verify tar.gz signature (7.0.x backport) Actions

BuildBot

open

Place to collect tickets about BuildBot ideas, suggestions, etc.

100%

7 issues   (7 closed — 0 open)

Related issues
Feature #633: open buildbot instance to the public Actions
Feature #655: openbsd 5.2 buildslave Actions
Feature #657: buildbot build with --enable-debug-validation Actions
Feature #658: buildbot pcap run with --enable-debug-validation Actions
Feature #661: buildbot addition of missing OSs Actions
Feature #974: valgrind leak check Actions
Feature #1011: integrate fuzzer into buildbot Actions

Packaging/PPA

open

79%

34 issues   (27 closed — 7 open)

Related issues
Feature #695: Ubuntu PPA Doesn't Install Any Rules Actions
Feature #699: packaging for Mac Actions
Feature #734: Ubuntu PPA should be compiled with unix socket support enabled Actions
Feature #905: PPA packaging - log directories check Actions
Feature #949: SUSE automatic package building system Actions
Feature #1216: Debian repository Actions
Feature #1819: Silent installer for suricata windows Actions
Feature #1822: Support for hiredis in Ubuntu PPA Actions
Feature #2150: Support for attaching Suricata to multiple NFQ's using the default startup script Actions

QA

open

69%

99 issues   (68 closed — 31 open)

Related issues
Feature #966: scan-build support in the buildbot Actions
Feature #1553: AppVeyor - TravisCI for Windows builds Actions
Feature #1963: travis-ci: OS X support Actions
Feature #2923: suricata-verify: eve2test util Actions
Feature #3082: suricata-verify: option to test 'skipped' tests Actions
Feature #3357: suricata-verify: parallel tests capability Actions
Feature #3464: suricata-verify: Add unix-socket support Actions
Feature #3975: Suricata-Verify: Add JSON schema validation to EVE output. Actions
Feature #4059: createst: Commandline param to specify Suricata version Actions
Feature #4060: createst: Commandline param to specify minimum required version of Suricata Actions
Feature #4061: createst: Commandline param to specify required features Actions
Feature #4062: createst: Allow to exclude certain fields Actions
Feature #4185: "requires" should be allowed to be defined per check and not just globally Actions
Feature #4203: createst: ability to create diff between a PR and master Actions
Feature #4268: createst: allow to add options with --set Actions
Feature #5262: run.py: should tell which fields are mismatching Actions
Feature #5630: SV: allow version controls for shell checks Actions
Feature #6112: suricata-verify: add a "fail: true" check for tests expected to fail Actions
Feature #6653: createst: dedup pcap used if it is from existing test Actions
Documentation #5878: Suricata-verify: add a section on how to contribute to it Actions

TBD

open

To be determined -- place holder for tickets that are not prioritized/scheduled yet

17%

830 issues   (138 closed — 692 open)

Related issues
Feature #121: Alert on domain name look up, capture traffic for corresponding IP Actions
Feature #249: Configure host-os-policy from a file, like snorts host_attribute.xml Actions
Feature #266: log http raw request for network forensic Actions
Feature #273: IRC protocol detection support Actions
Feature #276: Libcap support for dropping privileges Actions
Feature #294: Limit inspection of a stream and/or rule... Actions
Feature #328: Traceability and QA with regards to rules loaded Actions
Feature #365: expose interface(unix socket command) to reset tcp connection Actions
Feature #385: Configuration option to log all known (pcap) data for a stream when an alert fires Actions
Feature #425: Inspect the effects of mixing threshold and detection filters etc.. Actions
Feature #432: PCAP-NG support Actions
Feature #448: dlp: md5sum based on part of files Actions
Feature #465: benchmark runmode Actions
Feature #473: pcap log: alert log with packet indexes Actions
Feature #511: Port indepedent protocol identification (nDPI) Actions
Feature #535: new keywords - time , day Actions
Feature #544: Live traffic decryption Actions
Feature #547: libinjection -- sqli library Actions
Feature #584: lua: expose file buffers Actions
Feature #596: rule profiling: multiple outputs per run Actions
Feature #609: Active Response in inline mode (like react in snort 2.9+) Actions
Feature #659: Update IP reputation from unix socket. Actions
Feature #682: Add DEP and ASLR to Windows Binary Actions
Feature #716: configurable packet_stats.csv and packet_stats.log Actions
Feature #728: Add support for OpenCL Actions
Feature #745: Tunnel configuration Actions
Feature #776: rules: Add smtp_envelope and smtp_header keywords Actions
Feature #783: LuaJIT be able to return various messages for a single script. Actions
Feature #816: TCP SACK: limits per stream Actions
Feature #821: conditional logging: output steering Actions
Feature #843: Custom http logging filter functionality Actions
Feature #870: luajit: global vars Actions
Feature #880: memcap http parser Actions
Feature #902: VLAN host table support Actions
Feature #933: add a IPv6 ( RFC2460 recommended order of EH )rule to decoder events rules Actions
Feature #936: support tzsp protocol Actions
Feature #960: persistent TCP resets Actions
Feature #1002: Possible to disabling/bypassing a rule by a specific source ip and a destination ip? Actions
Feature #1015: add chained content info to rule analysis Actions
Feature #1025: seperate #ifdef UNITTEST code into their own files Actions
Feature #1095: Integration of support for STIX-based indicators Actions
Feature #1125: smtp: improve protocol detection Actions
Feature #1132: set rpath for libs not in the default linker paths Actions
Feature #1140: IP-Address white list implementation for IPS mode (without disable a rule global) Actions
Feature #1191: EVE log does not support customformat Actions
Feature #1194: Implement http_args keyword to match http arguments - query string or body Actions
Feature #1215: journald logging support Actions
Feature #1234: nfqueue: use mnl API Actions
Feature #1239: Best effort TCP stack Actions
Feature #1245: Add "drop-only" and "alert-only" option for pcap-log Actions
Feature #1250: protocol: Multipath TCP (mptcp) Actions
Feature #1290: handle SIGHUP signal Actions
Feature #1300: profiling: per flow recording of profiling data Actions
Feature #1323: automated eve.json rotation Actions
Feature #1348: OOBE -6- increasing max-pending-packets default value Actions
Feature #1380: JSON and Unified2 output "payload" does not contain full (or real in the case of Unified2) packets for session Actions
Feature #1389: suppress by host Actions
Feature #1469: Use ISO 8601 date/time formats Actions
Feature #1489: Log a message when memcap limit is reached Actions
Feature #1504: lua: better notification in verbose mode on script errors Actions
Feature #1505: lua: show lua scripts during rule (re)loading Actions
Feature #1541: multi-detect - vlan range mapping Actions
Feature #1566: ICMPv4 control channel detection Actions
Feature #1571: Socket permissions setting in suricata.yaml Actions
Feature #1590: lua: force file magic and md5 lookup from script Actions
Feature #1608: Add option to disable JSON escape slash Actions
Feature #1662: Disable action / rule ordering option Actions
Feature #1710: Unix socket: Send output to unix socket Actions
Feature #1712: multitenancy: 'lite' tenants Actions
Feature #1741: flow: use capture methods flow hash Actions
Feature #1750: Set Suricata to listen to all network interfaces when using AF_PACKET Actions
Feature #1752: Netmap for Windows Actions
Feature #1766: TLS keyword expansion Actions
Feature #1767: Support DTLS protocol Actions
Feature #1783: Create Suricata buffers to expose L2, L3, and L4 headers to Lua scripts Actions
Feature #1794: test suricata rules over unix-socket Actions
Feature #1799: netmap: capture drop stats Actions
Feature #1872: add --list-decoder-protos or similar Actions
Feature #1899: Detecting Malicious TCP Network Flows Based on Benford’s Law Actions
Feature #1939: Introduce packet/byte counter in stats.log/json for local bypass Actions
Feature #1950: allow configuration of file-store types Actions
Feature #1954: runtime option/flag to disable hardware timestamp support Actions
Feature #1956: Add option to re-initialise Lua output scripts Actions
Feature #1977: get the os info from TCP HTTP fingerprint Actions
Feature #1979: TCP/IP packets normalization/scrubbing Actions
Feature #1995: fast.log should show if packet has been dropped or rejected Actions
Feature #2021: doc: sha256 filesum extraction missing in documentation Actions
Feature #2055: Optionally logging on files.json - Not log every file, only certain files that are stored and extracted Actions
Feature #2092: Improved support for xbits/hostbits - workers runmode Actions
Feature #2107: eve: rotate log output based on size Actions
Feature #2115: Changing interfaces Actions
Feature #2145: Relate directly flowid with certificate file Actions
Feature #2147: fileinfo: sha1 hash not logged if state == TRUNCATED Actions
Feature #2166: output: log only triggering buffers Actions
Feature #2167: eve-ng Actions
Feature #2174: Need a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET Actions
Feature #2198: Extend the DNS parser to accept dns_response keyword in signatures Actions
Feature #2213: file matching: allow generic file matching / store Actions
Feature #2227: more detailed output about number of threads created Actions
Feature #2232: Allow Large value in suricata.yaml file Actions
Feature #2233: Allow log for payload and packet only for defined sid Actions
Feature #2262: Unix Socket Output Configurable Retries and Blocking Actions
Feature #2269: TLS: tls.version: allow negation or comparison Actions
Feature #2273: engine analysis: enable analysis by default during startup Actions
Feature #2277: netinfo: structured information about the network. Output hierarchical network tree in events Actions
Feature #2280: http: rules that match both request and response Actions
Feature #2281: tcp stream: simpler IDS handling of overlap evasions Actions
Feature #2291: traffic-id: ruleset for traffic classification and bypass Actions
Feature #2301: netflow: dump records at interval Actions
Feature #2308: threshold/suppress by http_host Actions
Feature #2310: lua: expose xbits Actions
Feature #2316: global memcap Actions
Feature #2342: Write PCAP files directly to Unix Socket Actions
Feature #2343: Add "flush" command to unix socket Actions
Feature #2371: list all available /exposed fields to lua Actions
Feature #2380: [discussion] deprecate: 'alert syslog' output Actions
Feature #2409: Push signatures without reloading the entire set. Actions
Feature #2410: Create a reset counter and track maximum number of parallel flows Actions
Feature #2426: tls: extend logging Actions
Feature #2487: Buffers for field/value pairs in http_uri and http_client_body Actions
Feature #2488: HTML Parsing / Buffers Actions
Feature #2513: Suricata read the SSLProxy header Actions
Feature #2519: XFF iprep support Actions
Feature #2538: dsize keyword improvements Actions
Feature #2569: multi-tenancy: allow mapping to 'device pair' in IPS mode Actions
Feature #2613: stats: add xdp counters to stats Actions
Feature #2628: Specify the flow direction in metadata sent by Suricata. Actions
Feature #2648: store captured data into file Actions
Feature #2661: output the http-body-data to eve.json Actions
Feature #2672: Split out DHCP parser to be reusable Actions
Feature #2673: Split out DNS parser to be reusable Actions
Feature #2674: Split out NFS parser to be reusable Actions
Feature #2675: Split out SMB parser to be reusable Actions
Feature #2681: Reloading of categories file, IP reputation list during rule live reload Actions
Feature #2700: ja3/ja3s functionality for IKEv2 Actions
Feature #2701: flow: counter for allocations at runtime Actions
Feature #2713: protocol detection w/o protocol parsing Actions
Feature #2727: DCERPC UID to name mapping Actions
Feature #2746: Use Available Instruction Set Specialization (AVX2 and AVX512) in Hyperscan when available Actions
Feature #2755: vendor id / vid keyword to give rulesets unique sid ranges Actions
Feature #2756: rules: input in json format Actions
Feature #2757: improve protocol detection Actions
Feature #2759: iprep: more granularity Actions
Feature #2764: dns logging v1 vs v2 Actions
Feature #2767: Interception of network stack attacks Actions
Feature #2771: MPLS over Vlan support Actions
Feature #2772: Add MPLS labels to alert output Actions
Feature #2818: Napatech Bypass support Actions
Feature #2860: Suricata doesn't detect part of IKEv2 traffic Actions
Feature #2871: lua: Exposing byte extract to script Actions
Feature #2925: Support for SPB encapsulation Actions
Feature #2931: Perform privdrop without libcap-ng support Actions
Feature #2932: add batman-adv decode support Actions
Feature #2935: Support for multiple-logger for drop eve-log Actions
Feature #2939: Suricata enhancements - proposals Actions
Feature #2957: Suricata x Moloch - protocol detection. Proposals for TLS/SSL Actions
Feature #2962: eve: log more IKEv2 fields Actions
Feature #2987: Suggestions for new keywords (streambits) Actions
Feature #2996: Extend decode events and rules Actions
Feature #3042: stats: allow per second stats updates Actions
Feature #3105: Add kafka output Actions
Feature #3212: Prevent duplicate pcaps from being re-processed Actions
Feature #3243: POP3 Support Actions
Feature #3244: IMAP Support Actions
Feature #3245: Email extraction to separate folder Actions
Feature #3246: Logging of Email body Actions
Feature #3260: SMTP Base64 Decoding of Message Body Actions
Feature #3261: SMTP quoted-printable Decoding of Message Body Actions
Feature #3271: Add keyword to determine flow based speed/bw Actions
Feature #3290: use config vars everywhere Actions
Feature #3295: Unix socket: support to receive flow shunting information Actions
Feature #3296: Include in the fileinfo if it was a duplicate Actions
Feature #3298: Create a config flag in the DNS logger to limit events to only the ones in the custom field Actions
Feature #3310: ease suricata configuration with xdp Actions
Feature #3311: Add better default suricata configuration for different traffic sizes and cpu/system architectures Actions
Feature #3316: Unix socket: support dumping flow table Actions
Feature #3317: rules: use rust for tokenizing rules Actions
Feature #3319: on 'wrong thread' reinject packets to correct thread Actions
Feature #3321: Evaluate different encoders for eve-log Actions
Feature #3333: Research: Unwind panic's from Rust modules Actions
Feature #3338: vxlan: log vni in eve Actions
Feature #3373: add init service file example script for Debian/Ubuntu Actions
Feature #3383: nflog: use mnl api Actions
Feature #3548: Support GTP(GPRS Tunnelling Protocol). Actions
Feature #3629: Publish the Suricata support Python libraries to PyPI (make pip installable) Actions
Feature #3663: DNS: Parse and extract DNS NULL records Actions
Feature #3675: Testimony support Actions
Feature #3688: Re-implement fast_pattern:only; in some way Actions
Feature #3894: Option "ttl" exclusive range behavior is non-intuitive Actions
Feature #4093: Extend stats log to print packet and byte rate on protocols Actions
Feature #4147: Map rules to MITRE ATT&CK Actions
Feature #4148: Research: SSH Support for additional protocol analysis Actions
Feature #4149: Research: Dynamic datasets Actions
Feature #4150: Profiling mode: Ticks used to generate an alert available? Actions
Feature #4175: dcerpc: higher level logging Actions
Feature #4249: SS7 Protocol Support Actions
Feature #4250: Diameter Protocol Support Actions
Feature #4325: xdp compile warnings on 5.4 kernels Actions
Feature #4381: flowbits: warn if flowbit dependencies don't follow suricata inspection order Actions
Feature #4398: support regex match and flowvars as keywords value Actions
Feature #4547: pcrexform not support tcp and other protocol Actions
Feature #4573: add IPS drop total to eve log output Actions
Feature #4649: Autonomous System Number (ASN) support similar to GeoIP Actions
Feature #4775: lua: overhaul lua support Actions
Feature #4951: decode: datalink type 276 not yet supported Actions
Feature #4974: Log references to Eve Actions
Feature #4985: quic: support frames Actions
Feature #5051: output/frames: allow tx logging to reference frames Actions
Feature #5067: smb/dcerpc: Match dcerpc (over smb) requests before bind_ack Actions
Feature #5069: smb: SMB keyword for match the smb command Actions
Feature #5128: Light weight packet profiling Actions
Feature #5152: Anomaly: CredSSP support addition to Suricata anomaly parsing Actions
Feature #5206: Buffer Dump Utility Actions
Feature #5209: Add "status" mode to Suricata's socket command interface Actions
Feature #5245: allow fast_pattern on base64_data strings Actions
Feature #5247: Applayer Detect protocol only one direction : RTSP protocol Actions
Feature #5365: Limit rust 'filetracker' memory in configuration Actions
Feature #5372: Add support for encrypted traffic analysis Actions
Feature #5405: Make suricata point to where to report a bug Actions
Feature #5440: multiple stats EVE logs with different intervals Actions
Feature #5450: Rule keyword for non midstream flows Actions
Feature #5461: eve: Use threaded output by default Actions
Feature #5469: rules: expose per flow stream.midstream setting to the rule language Actions
Feature #5470: reject: allow reject dev to be specified in the yaml Actions
Feature #5499: PCAP-over-IP client Actions
Feature #5618: setup-app-layer: add option to choose TCP/UDP protocol Actions
Feature #5639: Allow dataset to match on extracted domain Actions
Feature #5640: frames: tx frames Actions
Feature #5641: dns: frame based keywords for "raw" fields in requests and responses Actions
Feature #5646: rules: allow matching on flow pkts and bytes Actions
Feature #5647: rules: mark flow as elephant flow Actions
Feature #5648: flowworker: heuristic to see how busy a thread is with elephant flows Actions
Feature #5649: eve.flow: add thread id(s) processing a flow to the record Actions
Feature #5650: unix socket: query threads about most recent elephant flows Actions
Feature #5655: host: make memuse and memcap reached counters for host table Actions
Feature #5657: byte_test: allow comparison with static value Actions
Feature #5668: eve: optionally add rule fast_pattern Actions
Feature #5670: Support wide strings somehow Actions
Feature #5673: capture: option to decapsulate everything first Actions
Feature #5674: Support layered protocols Actions
Feature #5675: protocol: MMS SCADA support Actions
Feature #5676: ASN1 Spec to Rust nom generator Actions
Feature #5677: protocol: BGP support Actions
Feature #5681: datasets: add more transform layers to match on domains Actions
Feature #5687: eve: "auth" and/or "auth_fail" log Actions
Feature #5705: Add Wireguard parser Actions
Feature #5716: rdp: add app-layer frame support Actions
Feature #5727: krb: add frame support Actions
Feature #5728: modbus: add frame support Actions
Feature #5729: bittorrent-dht: add frame support Actions
Feature #5730: dhcp: add frame support Actions
Feature #5732: ntp: add frame support Actions
Feature #5733: snmp: add frame support Actions
Feature #5734: ssh: add frame support Actions
Feature #5743: http2: add frame support Actions
Feature #5745: exceptions: allow setting via unix-socket Actions
Feature #5752: Proposed new DNP3 keywords and operators Actions
Feature #5764: logging: add a format string for a more standard log format Actions
Feature #5776: PCRE fast_patterns via hyperscan Actions
Feature #5798: New transformation: dropbytes Actions
Feature #5872: file structure awareness - precise identification of fields in file structs Actions
Feature #5894: file: file classification keyword Actions
Feature #5913: rfb: add more record types Actions
Feature #5956: Report traffic with missing VLAN tag Actions
Feature #6004: Add retry option to redis outputs using a socket instead of IP Actions
Feature #6051: app-layer: dhcpv6 support Actions
Feature #6067: Add field to track SID of Flowbit Matches Actions
Feature #6101: icap: app-layer protocol support Actions
Feature #6102: Translate NAT64 ranges (also custom ranges) Actions
Feature #6167: Stream retransmissions stats counters Actions
Feature #6198: Feature Request: Add "SMTP" keywords for use in rules Actions
Feature #6200: output: suricata.yaml dump-all-headers applied for alerts Actions
Feature #6206: Investigate a more intuitive use of the timestamp field in traffic/metadata events Actions
Feature #6214: mirror ruleset reload commands for tenants in suricata socket control Actions
Feature #6216: http: HHHash support Actions
Feature #6251: AF-XDP ability to bind custom program Actions
Feature #6268: Recognize related ICMP request/response pairs Actions
Feature #6295: output: add stream-size to flow output Actions
Feature #6296: smtp: BDAT chunking support incl MIME parsing Actions
Feature #6409: Lua support for HTTP/2 Actions
Feature #6417: Allow base64_decode/base64_data to consume transforms Actions
Feature #6453: Support DNS over TLS Actions
Feature #6456: output: binary logging Actions
Feature #6457: eve: configurable list of fields in output Actions
Feature #6462: IEC104 Protocol Support Actions
Feature #6464: protocol: profibus Actions
Feature #6465: multi-tenant: support vxlan as a selector Actions
Feature #6466: multi-tenant: support mpls as a selector Actions
Feature #6467: flow tracking: add other parameters to flow tracking Actions
Feature #6468: flow-tracking: add geneve as a flow tracking parameter Actions
Feature #6469: flow-tracking: add erspan as a flow tracking parameter Actions
Feature #6470: flow-tracking: add vxlan as a flow tracking parameter Actions
Feature #6471: flow-tracking: add mpls as a tracking parameter Actions
Feature #6472: HTTP/3 support Actions
Feature #6482: Deployment: detect if capture is good enough Actions
Feature #6625: Apply netflow per network Actions
Feature #6649: Add a keyword to match on raw data within headers especially for protocols without a dedicated parser Actions
Feature #6650: dns: support extended response/error codes Actions
Feature #6651: quic: detect on non-standard ports Actions
Feature #6683: stats: add packet time elapsed indicator Actions
Feature #6693: byte_jump - add support for bitmask option Actions
Feature #6701: Auto-bypass optimization Actions
Feature #6723: detect: review existing keywords for usage of enumerations Actions
Feature #6724: detect: review existing keywords for usage of bitflags Actions
Feature #6794: Tie signature to live device in IPS mode Actions
Feature #6802: Support Domain rollup using existing dataset library Actions
Feature #6803: Add Support for Dataset Metadata Actions
Feature #6807: Support the use of variables within transforms Actions
Feature #6808: Quantify how a Suricata rule matches against a PCAP Actions
Feature #6823: SC_WARN_POOR_RULE on to_lowercase/to_uppercase transformation with non-possible matching content Actions
Feature #6831: support extraction of bytes of non-numeric values Actions
Feature #6832: Support BPFs for filtering pcap output Actions
Feature #6853: Support of variables from byte_math / byte_extract in bsize / dsize comparisons Actions
Feature #6857: iprep: support seeing if rule is part of a rep list Actions
Feature #6885: references: new "wayback" reference and update others Actions
Feature #6914: support inspecting http.uri or http.request_body Actions
Feature #6916: decoding : add support of IEEE 802.2, 802.3 frames Actions
Feature #6922: Have a way to manually request decompression/inflate if headers are not present Actions
Feature #6925: multi-buffer support for HTTP cookies Actions
Feature #6926: new buffer that includes HTTP headers and the start of HTTP body Actions
Documentation #595: document csum keywords Actions
Documentation #1233: Documentation for each keyword in stats.log file. Actions
Documentation #1691: Docs: Convert windows docs Actions
Documentation #1892: rule docs should include example rules Actions
Documentation #1974: DNP3: document lua support Actions
Documentation #2016: doc: improve keywords self documentation Actions
Documentation #2266: no documentation for file-store-waldo Actions
Documentation #2404: Windows Installation Guide for Suricata bug Actions
Documentation #2470: document content inspection in chunks Actions
Documentation #2585: document replace keyword Actions
Documentation #2588: document hostbits keyword Actions
Documentation #2589: document decode-event Actions
Documentation #2699: document all eve record types and fields Actions
Documentation #2976: review userguide from beginners point of view Actions
Documentation #3018: No documentation for "flowvar" keyword Actions
Documentation #3019: No documentation for "pktvar" keyword Actions
Documentation #3022: No documentation for "nfq_set_mark" keyword Actions
Documentation #3023: No documentation for "bsize" keyword Actions
Documentation #3025: Missing docs for "http." keywords Actions
Documentation #3027: No documentation for "nfs" keywords Actions
Documentation #3028: No documentation for "pkt_data" keyword Actions
Documentation #3031: No documentation for "asn1" keyword Actions
Documentation #3032: No documentation for "engine-event" keyword Actions
Documentation #3033: No documentation for "stream-event" keyword Actions
Documentation #3034: No documentation for "l3_proto" keyword Actions
Documentation #3035: No docs for "base64_" keywords Actions
Documentation #3036: No documentation for "template2" keyword Actions
Documentation #3046: Document each default value from the config file Actions
Documentation #3180: tracking: document all decoder and app-layer events Actions
Documentation #3181: document http engine events Actions
Documentation #3222: Configuring ipv6 Actions
Documentation #3268: Add links to additional information at the wiki to the userguide Actions
Documentation #3274: doc: some inconsistency between http docs keywords description Actions
Documentation #3303: Add a documentation about the used sid and gid ranges Actions
Documentation #3313: Document 40Gbps IPS set up Actions
Documentation #3751: Alert metadata JSON configs in suricata.yaml.in should match the RTD documentation Actions
Documentation #4662: Add documentation section covering Suricata rule grammar Actions
Documentation #4743: Improve Suricata code documentation (C files) Actions
Documentation #4768: DNS v2 EVE does not longer contain `dns.rdata` but it is still listed in the documentation Actions
Documentation #5030: Documentation bugs for endswith, distance, within Actions
Documentation #5182: userguide: better document rule keywords Actions
Documentation #5225: testing/fuzz: improve documentation on how to fuzz suricata Actions
Documentation #5267: Meaning of insert_list_fail counter Actions
Documentation #5359: userguide: improve documentation on (main) EVE fields Actions
Documentation #5367: byte_test: all examples in doc missing a required argument Actions
Documentation #5484: userguide: explain content modifiers usage with regards to position usage in the rule Actions
Documentation #5485: userguide: explain that the http.header_names buffer is normalized Actions
Documentation #5487: userguide: add explanation on how depth of inspection affects rules Actions
Documentation #5514: userguide: document exception policy from an extreme profiling and tuning perspective Actions
Documentation #5523: userguide: document the tcp-stream keyword Actions
Documentation #5537: devguide: add section/chapter about how [capture] bypassing works for Suricata Actions
Documentation #5591: devguide: bring section about OpenBSD Installation from git into devguide Actions
Documentation #5620: doc: add vectorscan instructions Actions
Documentation #5660: userguide: add (more) documentation for the GRE protocol Actions
Documentation #5662: Review/Update Hyperscan Documentation Actions
Documentation #5669: Better link together the bits keywords Actions
Documentation #5724: Why does reject-dev option work only in Sniff Mode Actions
Documentation #5772: docs: A wrong rule matching example provided by the official doc Actions
Documentation #5837: Unify documentation of command-line parameters Actions
Documentation #5841: tracker: bring documentation from old wiki on redmine to readthedocs guides Actions
Documentation #5995: userguide: ips upgrade guide Actions
Documentation #6059: docs: fix build failure - urllib3 issue Actions
Documentation #6071: eve/schema: add descriptions to the schema Actions
Documentation #6072: eve/schema: document smb Actions
Documentation #6073: eve/schema: document dns Actions
Documentation #6074: eve/schema: document nfs Actions
Documentation #6075: eve/schema: document http Actions
Documentation #6077: eve/schema: document sip Actions
Documentation #6096: eve/app-layer: generate example eve-log for each protocol Actions
Documentation #6097: eve/dhcp: generate example dhcp output Actions
Documentation #6098: eve/dns: generate example dns output Actions
Documentation #6133: tracking: security deployment documentation Actions
Documentation #6150: doc: improve the file-store documentation for the eve output and the dedicated section Actions
Documentation #6288: eve/schema: generate tables of data for app-layer protocols Actions
Documentation #6386: Add tls.cert_chain_len Documentation Actions
Documentation #6548: http.stat_msg - note about HTTP/2 behavior Actions
Documentation #6694: placement of bitmask note about right shift behavior Actions
Documentation #6824: doc: Document every parameter of the configure script Actions
Documentation #6924: replicate http.cookie behavior from "Differences From Snort" to http.cookie Actions
Documentation #6982: offset: no documentation that offset can be a name Actions
Documentation #6991: add note about case sensitivity to flowbits docs Actions
Security #5851: Rust: handle allocation failures Actions

Suricata-Update - TBD

open

To be determined

21%

28 issues   (6 closed — 22 open)

Related issues
Suricata-Update - Feature #2256: Generate a report and log it to a file. Actions
Suricata-Update - Feature #2509: Add support to have more than one condition to match a rule Actions
Suricata-Update - Feature #2659: Define the output rules file name. Actions
Suricata-Update - Feature #2938: Add a "show-defaults" command Actions
Suricata-Update - Feature #3202: classtypes: validate classtypes in use Actions
Suricata-Update - Feature #3721: Add iprep compatibility Actions
Suricata-Update - Feature #4355: Easy way to disable all engine provided rules. Actions
Suricata-Update - Feature #4479: Work on FIPS compliant CentOS releases. Actions
Suricata-Update - Feature #4481: list-sources: list locally added sources, and make it clear they are local sources Actions
Suricata-Update - Feature #6131: threshold.conf: reconcile current threshold.conf with current state of rules Actions
Suricata-Update - Feature #6202: Resolve xbits dependencies Actions
Suricata-Update - Documentation #3038: documentation: Setup directories with correct permissions Actions