Project

General

Profile

Roadmap

7.0.15

open

Due in 24 days (03/17/2026)

26%

25 issues   (6 closed — 19 open)

Related issues
Feature #7443: exception-policy: stream async policy (7.0.x backport) Actions
Documentation #8218: rules/endswith: doc wrong for offset/distance/within warning (7.0.x backport) Actions
Documentation #8241: isdataat: document different semantics between absolute and relative modes (7.0.x backport) Actions
Documentation #8264: doc/userguide: fix within-distance pointer graphics in payload-keywords doc (7.0.x backport) Actions

8.0.4

open

Due in 24 days (03/17/2026)

29%

58 issues   (17 closed — 41 open)

Related issues
Feature #7893: hyperscan: support cache invalidation and removal (8.0.x backport) Actions
Feature #7942: exception-policy: stream async policy (8.0.x backport) Actions
Feature #8085: dpdk: in dpdk runmode initiialize EAL threads (8.0.x backport) Actions
Feature #8228: hyperscan: test cache creation and pruning in CI (8.0.x backport) Actions
Feature #8229: dpdk: recognize net_pcap driver and stop after no packets are rx_bursted (8.0.x backport) Actions
Feature #8233: nfs: log detailed response for versions other than v3 (8.0.x backport) Actions
Feature #8234: rules: extend byte_extract named variables for use in other keywords/transformations such as xor (8.0.x backport) Actions
Feature #8235: rules/transform: add gunzip transform (8.0.x backport) Actions
Documentation #7913: userguide: document transaction loggers can be registered from a plugin (8.0.x backport) Actions
Documentation #7918: doc/userguide: document terminating behavior of rule actions (8.0.x backport) Actions
Documentation #7930: userguide: document behavior for actions like PASS, DROP, REJECT, BYPASS... (8.0.x backport) Actions
Documentation #7932: devguide: add a chapter about Suricata's exception policies (8.0.x backport) Actions
Documentation #7933: devguide: document how the alert flow works (8.0.x backport) Actions
Documentation #7944: eve/schema: document stats.decoder counters (8.0.x backport) Actions
Documentation #7945: doc/actions: clarify 'pass' scope variations (8.0.x backport) Actions
Documentation #7946: userguide: add section on SMTP event type (8.0.x backport) Actions
Documentation #7947: doc/configuration: clarify sig_id & gid_id for global threshold (8.0.x backport) Actions
Documentation #7948: userguide: describe what are the delta stats counters (8.0.x backport) Actions
Documentation #7954: doc: umask option not documented (8.0.x backport) Actions
Documentation #8114: doc: remove mention of suricata-7 in latest docs (8.0.x backport) Actions
Documentation #8217: rules/endswith: doc wrong for offset/distance/within warning (8.0.x backport) Actions
Documentation #8240: isdataat: document different semantics between absolute and relative modes (8.0.x backport) Actions
Documentation #8263: doc/userguide: fix within-distance pointer graphics in payload-keywords doc (8.0.x backport) Actions
Security #8287: krb5: TCP parser never advances past the first record in a multi-record segment (8.0.x backport) Actions

9.0.0-beta1

open

Due in about 14 months (04/06/2027)

31%

557 issues   (157 closed — 400 open)

Related issues
Feature #635: output: missing keywords in list-keywords output Actions
Feature #682: Add DEP and ASLR to Windows Binary Actions
Feature #1005: conditional logging: controlling what gets logged Actions
Feature #1542: dump-config - extend into multi-detect supplied yaml configuration Actions
Feature #1954: af-packet: runtime option/flag to disable hardware timestamp support Actions
Feature #1979: TCP/IP packets normalization/scrubbing Actions
Feature #1983: tls: events are directionless and trigger twice per flow direction Actions
Feature #1993: commandline: introduce --enable-all-outputs switch Actions
Feature #2375: Design and implement sensible per-thread capabilities Actions
Feature #2448: dns: additional buffers for DNS Responses Actions
Feature #2487: rules: buffers for field/value pairs in http.uri and http.client_body Actions
Feature #2678: list-keywords: add info about fast_pattern and transforms Actions
Feature #2958: Suricata 5.0.0beta1 and way too much anomaly logging Actions
Feature #3003: filestore to uses rename syscall instead of sendfile,which doesn't allow files to be sent across file systems Actions
Feature #3026: Windows MSI - add in service scripts Actions
Feature #3065: tls_cert_XX keywords date format parsing error Actions
Feature #3236: output: list-keywords does not match on aliases Actions
Feature #3243: POP3 Support Actions
Feature #3338: vxlan: log vni in eve Actions
Feature #3446: app-layer: implement MySQL parser Actions
Feature #3636: eve: configuration options to enable all, none or just a default set of outputs Actions
Feature #3953: 8021BR E packet decoder Actions
Feature #4089: rules: Flexible format transform Actions
Feature #4136: configure: use Suricata-Update managed classification.config Actions
Feature #4153: app-layer: rust derive style macros to generate common code Actions
Feature #4174: tracking: app-layer frame inspection support Actions
Feature #4226: bsize: apply as depth to patterns Actions
Feature #4566: pgsql: add subprotocol-states Actions
Feature #4854: pgsql: Add COPY subprotocol-state Actions
Feature #4855: rules: refactor rule parsing into multi-stage parser Actions
Feature #4861: smb: support multi-stream file transfers Actions
Feature #4876: Additional FTP Buffers Actions
Feature #4906: ftp: add stream app-layer frame support Actions
Feature #4910: dpdk: implement secondary mode Actions
Feature #4946: nfsv2: implement WRITE support Actions
Feature #4965: protocol: SOCKS support Actions
Feature #4986: pgsql: support frames Actions
Feature #4990: eve/frames: make payload logging configurable Actions
Feature #5029: eve: telnet logger Actions
Feature #5044: rules: keyword for "count" of http_header_names Actions
Feature #5049: detect/frames: allow mixing with txs Actions
Feature #5194: tracking: options for simulating various exceptions Actions
Feature #5203: dpdk: implement primary app for Suricata secondary mode Actions
Feature #5217: ips: allow dropping of flow if applayer specific memcap is hit Actions
Feature #5286: ips: allow dropping of packet/flow when alert queue exceeded Actions
Feature #5415: tftp: support keywords such as file.name, file.data etc... Actions
Feature #5495: implement grace period for midstream exception policy Actions
Feature #5576: Dataset is setting data despite the signature being a complete match Actions
Feature #5640: frames: tx frames Actions
Feature #5642: DNS: parity between log fields and detection Actions
Feature #5664: "Scope" bits should have an expiration Actions
Feature #5726: ike: add frame support Actions
Feature #5775: rules: http.headers - dynamic sticky buffers Actions
Feature #5826: frames: logging of events set on frames Actions
Feature #5838: dpdk: NIC encapsulation stripping Actions
Feature #5845: smb: Support SMB_COM_SESSION_SETUP_ANDX Request Actions
Feature #5973: warn when HTTP rules will only work for a specific version of HTTP Actions
Feature #5974: flow: midstream exception policy "reject-both" support Actions
Feature #6063: exception-policy: stream async policy Actions
Feature #6091: eve/alert: missing dhcp metadata Actions
Feature #6114: dpdk: wrap DPDK logs in a Suricata logger Actions
Feature #6210: outputs: add verdict event type Actions
Feature #6214: multi-tenant: suricatasc command with parity with non-tenant commands for rules Actions
Feature #6216: http: HHHash support Actions
Feature #6237: Multi-tenancy: Allow inner VLAN to be selected Actions
Feature #6261: Add GRE as a parsible protocol Actions
Feature #6293: Support disabling forced flow reuse in low memory conditions Actions
Feature #6368: stream/midstream: wscale setting Actions
Feature #6399: Per-thread stats values can be negative Actions
Feature #6409: lua: add HTTP/2 lib Actions
Feature #6422: dpdk: expand on DPDK allocation hints Actions
Feature #6424: HTTP/2 - http.host behavior when both :authority pseudo header and host header are present Actions
Feature #6459: filebits: support for new type of bits Actions
Feature #6472: HTTP/3 support Actions
Feature #6651: quic: detect on non-standard ports Actions
Feature #6693: detect/byte_jump: add support for bitmask option Actions
Feature #6723: detect: review existing keywords for usage of enumerations Actions
Feature #6724: detect: review existing keywords for usage of bitflags Actions
Feature #6729: websockets: support over HTTP/2 Actions
Feature #6831: rules: support extraction of bytes of non-numeric values Actions
Feature #6927: dpdk: add unit tests for threading and mempool cache size functions Actions
Feature #6936: landlock: enable by default Actions
Feature #6956: mqtt: create PDU frames without regard to the parsing function Actions
Feature #6996: add transformation to keyword performance stats Actions
Feature #6999: output/json: enrich EVE w/ libmaxminddb geoip info Actions
Feature #7062: redis: support authenticating against a redis server Actions
Feature #7068: protocol support: STUN Actions
Feature #7070: eve: internal state output facility Actions
Feature #7092: frames: support rules with multiple different frames Actions
Feature #7109: app-layer: stop generating anomalies after gap in the flow Actions
Feature #7117: dpdk: hardware timestamping for packets Actions
Feature #7125: threshold: by_src, by_dst, by_both should support vlan separation Actions
Feature #7177: http1: add frame support Actions
Feature #7211: detect/integers: support a count argument for array of integers Actions
Feature #7245: Add SIMD support for arm64 Actions
Feature #7313: transforms: have option on how to handle failure Actions
Feature #7347: eve/alert: log file_data Actions
Feature #7351: transform/from_base64: Support "relative" offsets Actions
Feature #7354: detect: reimplement ip-only as a per group prefilter Actions
Feature #7399: ipv6: support short notation of ipv6 addresses in output Actions
Feature #7401: yaml: add schema Actions
Feature #7438: detect: add flow.rate keyword Actions
Feature #7470: detect/ldap: add ldap.bind.version keyword Actions
Feature #7480: detect/integers: array of integers should support an optional second argument to specify the index Actions
Feature #7514: rules: add file specific hooks Actions
Feature #7519: dpdk: verify the driver is DPDK-compatible on Intel cards Actions
Feature #7534: detect/ldap: add ldap.request.message_id and ldap.responses.message_id Actions
Feature #7536: detect/ldap: add keywords for LDAP BindRequest Actions
Feature #7537: detect/ldap: add keywords for LDAP SearchRequest Actions
Feature #7538: detect/ldap: keyword ldap.modify_request.operation Actions
Feature #7539: detect/ldap: add keyword ldap.mod_dn_request.new_rdn Actions
Feature #7566: dcerpc: applayer events for anomalous parsing results Actions
Feature #7571: list-keywords should somehow show the multi-buffer keywords Actions
Feature #7586: mime: expose 'headers' as a keyword Actions
Feature #7587: mime: add email.body_md5 keyword Actions
Feature #7600: mime: add rule keywords Actions
Feature #7629: dpdk: support for a hardware-accelerated input drop filter Actions
Feature #7646: pgsql: add CopyBoth subprotocol/mode Actions
Feature #7666: rust: zero-dependency crate suricata-ffi Actions
Feature #7672: detect/transforms: subslice transform Actions
Feature #7674: source/tunnels: config option to distinguish tunnels Actions
Feature #7691: detect: explore code embedded relationships between registered keywords Actions
Feature #7699: firewall: separate stats for ips and firewall Actions
Feature #7711: tracking: detect: add detection hooks to inspect/drop before stateful components Actions
Feature #7717: vxlan: treat as its own tunnel Actions
Feature #7739: github-ci: add PCAP file reading tests Actions
Feature #7768: ips: improve file.data support Actions
Feature #7786: pcap: Enhance --pcap-file-delete to Conditionally Delete PCAPs Based on Alerts Actions
Feature #7801: Support multi-buffer byte variables Actions
Feature #7816: Add alternative to file magic Actions
Feature #7830: hyperscan: support cache invalidation and removal Actions
Feature #7832: github-ci: add live hyperscan caching tests Actions
Feature #7846: rules/transform: add gunzip transform Actions
Feature #7847: rules: extend byte_extract named variables for use in other keywords/transformations such as xor Actions
Feature #7848: rules: extend pcrexform for use outside of existing suricata buffers Actions
Feature #7871: dpdk: rte_flow capture bypass Actions
Feature #7875: list-keywords should somehow show the integer keywords Actions
Feature #7894: output: log http2.window when needed Actions
Feature #7904: http: support zstd compression Actions
Feature #7928: rules: distinct counting logic Actions
Feature #7929: detect/integers: support optional second argument to specify the index for all keywords Actions
Feature #7955: c: create files with explicit permissions Actions
Feature #7956: rust: create files with explicit permissions Actions
Feature #7979: sslproxy: add support for parsing decrypted traffic Actions
Feature #7986: protocol decoder: l2tpv3 Actions
Feature #7995: pop3: email mime parsing Actions
Feature #8006: nfs: NFSv4 should support 4.1's new enums Actions
Feature #8084: dpdk: in dpdk runmode initialize EAL threads Actions
Feature #8099: multi-tenant: optionally reload tenant rules on SIGUSR2 Actions
Feature #8116: Quic: encryption-handling config parameters Actions
Feature #8117: rules: flow.elephant keyword Actions
Feature #8128: rules/transform: add json_decode transform Actions
Feature #8130: http: http.uri should normalize the + into space as per RFC 1886 Actions
Feature #8138: windivert: Build using WinDivert 2 Actions
Feature #8139: defrag: alert on / reject >=3 layer overlaps Actions
Feature #8174: frames: add --list-frames option Actions
Feature #8179: dcerpc.opnum: doesn't support operators >,<,!,= Actions
Feature #8222: nfs: log detailed response for versions other than v3 Actions
Feature #8225: dpdk: recognize net_pcap driver and stop after no packets are rx_bursted Actions
Feature #8227: hyperscan: test cache creation and pruning in CI Actions
Feature #8250: rules: distinct ip counting logic Actions
Feature #8262: decoder: add IGMP support Actions
Feature #8276: imap: add parser, logger and sticky buffers Actions
Feature #8285: firewall: support iprep in firewall mode Actions
Documentation #2620: userguide: document tagged_packets / event_type packet Actions
Documentation #3028: No documentation for "pkt_data" keyword Actions
Documentation #4350: doc/devguide: transaction handling logic Actions
Documentation #4352: Devguide: Debugging Basics - pcap_cnt Actions
Documentation #4557: Add document about JsonBuilder Actions
Documentation #4658: Add/improve documentation for pcre substring capture logging Actions
Documentation #4705: userguide: add sections about frame support Actions
Documentation #4708: devguide: Add Eve Output Plugins Actions
Documentation #4709: userguide: Add page about analyzing Suricata performance Actions
Documentation #4980: doc/frames: document frame rule keyword Actions
Documentation #5008: userguide: add a protocol chart listing defaults Actions
Documentation #5030: rules/endswith: doc wrong for offset/distance/within warning Actions
Documentation #5267: Meaning of insert_list_fail counter Actions
Documentation #5274: devguide: document how the alert flow works Actions
Documentation #5465: doc/userguide: document terminating behavior of rule actions Actions
Documentation #5477: Json schema doesn't support thread stats Actions
Documentation #5532: userguide: have a section to mention and document the various ways stream-depth can be set Actions
Documentation #5534: userguide: better document what TCP midstreams are for Suricata Actions
Documentation #5543: userguide: document which keywords accept the prefilter keyword Actions
Documentation #5554: userguide: document behavior for actions like PASS, DROP, REJECT, BYPASS... Actions
Documentation #5575: docs: bring 'reporting bugs page' into userguide and update it Actions
Documentation #5612: devguide: add a chapter about Suricata's exception policies Actions
Documentation #5829: userguide: add context on "why/when an exception policy is applied" Actions
Documentation #5830: userguide: update & improve exception policy section Actions
Documentation #5869: userguide: describe what are the delta stats counters Actions
Documentation #5891: userguide: explain different log save directory in offline mode Actions
Documentation #5897: devguide: add section on generating code coverage reports locally Actions
Documentation #5910: devguide: explain possible differences in data inspection with inline stream or not Actions
Documentation #6026: userguide/suricata-yaml: update image on threading Actions
Documentation #6030: devguide: expand Suricata Internals chapter Actions
Documentation #6058: doc/configuration: clarify sig_id & gid_id for global threshold Actions
Documentation #6075: eve/schema: document http Actions
Documentation #6078: eve/schema: document pgsql Actions
Documentation #6096: eve/app-layer: generate example eve-log for each protocol Actions
Documentation #6097: eve/dhcp: generate example dhcp output Actions
Documentation #6098: eve/dns: generate example dns output Actions
Documentation #6180: userguide: add troubleshooting section Actions
Documentation #6219: userguide: add page about different usecases Actions
Documentation #6369: stream: document stream.3whs_syn_flood and stream.3whs_synack_flood Actions
Documentation #6406: userguide: remove ambiguous "we" usages Actions
Documentation #6412: devguide: API upgrade notes Actions
Documentation #6434: eve/schema: document stats Actions
Documentation #6442: rtd: indicate that a page is for an outdated version Actions
Documentation #6451: userguide: update 'what is suricata' section Actions
Documentation #6452: userguide/ftp: clarify usage around ftp and ftp.data keyword Actions
Documentation #6484: userguide: add keyword performance results Actions
Documentation #6486: userguide: explain pkt_on_wrong_thread counter Actions
Documentation #6492: doc: explain how FTP works Actions
Documentation #6495: userguide: add section on SMTP event type Actions
Documentation #6626: devguide: add instructions for MacOS setup Actions
Documentation #6824: doc: Document every parameter of the configure script Actions
Documentation #7174: docs: investigate if RtD AddOns will impact our guides Actions
Documentation #7277: doc/actions: clarify 'pass' scope variations Actions
Documentation #7348: userguide: explain SYSTEM and USER mode Actions
Documentation #7424: devguide: document pseudo packets Actions
Documentation #7580: userguide: add section for negated content Actions
Documentation #7662: userguide: add section for rule hooks Actions
Documentation #7680: userguide: document tx scoped xbits Actions
Documentation #7722: docs: add a glossary chapter Actions
Documentation #7755: doc: document ethtool offloads for common use Actions
Documentation #7793: eve/schema: document stats.decoder counters Actions
Documentation #7840: userguide: document transaction loggers can be registered from a plugin Actions
Documentation #7921: docs: disambiguate 'frame' word usage Actions
Documentation #7937: docs: update backports policy for Suricata 7.0.x Actions
Documentation #7953: doc: umask option not documented Actions
Documentation #8011: userguide: document behavior/support for stream.async-oneside Actions
Documentation #8031: isdataat: document different semantics between absolute and relative modes Actions
Documentation #8035: transform/luaxform: documentation states it supports init function Actions
Documentation #8113: doc: remove mention of suricata-7 in latest docs Actions
Documentation #8135: luaxform: options incorrectly described Actions
Documentation #8137: windivert: Add WinDivert to Windows build instructions Actions
Documentation #8261: doc/userguide: fix within-distance pointer graphics in payload-keywords doc Actions
Security #6187: detect: handle allocation failures during rule reload Actions
Security #8021: eve/alert: heap buffer overflow on verdict Actions
Security #8065: lua: stack overflow from unbounded stack allocation in LuaPushStringBuffer Actions
Security #8278: krb5: TCP parser never advances past the first record in a multi-record segment Actions

9.0.0

open

Due in about 17 months (07/01/2027)

9%

11 issues   (1 closed — 10 open)

Related issues
Story #7583: 9.0.0: usecase: improve firewall usecase Actions
Story #7584: 9.0.0: protocols: protocol additions Actions
Story #7760: 9.0.0: deployment: improve secure deployment Actions
Story #7761: 9.0.0: protocols: C to Rust conversions Actions
Story #7900: 9.0.0: rules: improve rule language Actions
Story #7901: 9.0.0: rules: improve rules keyword/output parity Actions
Story #8098: 9.0.0: libsuricata Actions

7.0.16

open

No issues for this version

7.0.17

open

No issues for this version

8.0.5

open

No issues for this version

8.0.6

open

No issues for this version

Packaging/PPA

open

80%

35 issues   (28 closed — 7 open)

Related issues
Feature #695: Ubuntu PPA Doesn't Install Any Rules Actions
Feature #699: packaging for Mac Actions
Feature #734: Ubuntu PPA should be compiled with unix socket support enabled Actions
Feature #905: PPA packaging - log directories check Actions
Feature #949: SUSE automatic package building system Actions
Feature #1216: Debian repository Actions
Feature #1822: Support for hiredis in Ubuntu PPA Actions
Feature #2150: Support for attaching Suricata to multiple NFQ's using the default startup script Actions
Feature #2773: add suricata-update to MSI packaging Actions
Feature #4222: Add PPA pkg build checks to qa runs Actions
Feature #4445: Switch to systemd in PPA packages Actions

QA

open

66%

113 issues   (75 closed — 38 open)

Related issues
Feature #966: scan-build support in the buildbot Actions
Feature #1553: AppVeyor - TravisCI for Windows builds Actions
Feature #1963: travis-ci: OS X support Actions
Feature #2923: suricata-verify: eve2test util Actions
Feature #3082: suricata-verify: option to test 'skipped' tests Actions
Feature #3357: suricata-verify: parallel tests capability Actions
Feature #3464: suricata-verify: Add unix-socket support Actions
Feature #3975: Suricata-Verify: Add JSON schema validation to EVE output. Actions
Feature #4059: createst: Commandline param to specify Suricata version Actions
Feature #4060: createst: Commandline param to specify minimum required version of Suricata Actions
Feature #4061: createst: Commandline param to specify required features Actions
Feature #4062: createst: Allow to exclude certain fields Actions
Feature #4185: "requires" should be allowed to be defined per check and not just globally Actions
Feature #4203: createst: ability to create diff between a PR and master Actions
Feature #4268: createst: allow to add options with --set Actions
Feature #5262: run.py: should tell which fields are mismatching Actions
Feature #5630: SV: allow version controls for shell checks Actions
Feature #6112: suricata-verify: add a "fail: true" check for tests expected to fail Actions
Feature #6653: createst: dedup pcap used if it is from existing test Actions
Feature #7139: createst: identify pcap path from existing SV test Actions
Feature #7156: createst: automatically add --simulate-ips commandline argument Actions
Feature #7413: suricata-verify: allow a timeout setting in test.yaml Actions
Feature #7695: runner: add check for empty objects (schema) Actions
Documentation #5878: Suricata-verify: add a section on how to contribute to it Actions
Documentation #7039: suricata-verify: explain how to automatically add --simulate-ips argument Actions
Documentation #7077: docs: script to check whether containers exist in css styles Actions

TBD

open

To be determined -- place holder for tickets that are not prioritized/scheduled yet

24%

1111 issues   (264 closed — 847 open)

Related issues
Feature #121: Alert on domain name look up, capture traffic for corresponding IP Actions
Feature #249: Configure host-os-policy from a file, like snorts host_attribute.xml Actions
Feature #266: log http raw request for network forensic Actions
Feature #273: IRC protocol detection support Actions
Feature #276: Libcap support for dropping privileges Actions
Feature #294: Limit inspection of a stream and/or rule... Actions
Feature #328: Traceability and QA with regards to rules loaded Actions
Feature #365: expose interface(unix socket command) to reset tcp connection Actions
Feature #385: Configuration option to log all known (pcap) data for a stream when an alert fires Actions
Feature #425: Inspect the effects of mixing threshold and detection filters etc.. Actions
Feature #432: PCAP-NG support Actions
Feature #448: dlp: md5sum based on part of files Actions
Feature #465: benchmark runmode Actions
Feature #473: pcap log: alert log with packet indexes Actions
Feature #511: Port indepedent protocol identification (nDPI) Actions
Feature #535: new keywords - time , day Actions
Feature #544: Live traffic decryption Actions
Feature #547: libinjection -- sqli library Actions
Feature #584: lua: expose file buffers Actions
Feature #596: rule profiling: multiple outputs per run Actions
Feature #609: Active Response in inline mode (like react in snort 2.9+) Actions
Feature #659: Update IP reputation from unix socket. Actions
Feature #716: configurable packet_stats.csv and packet_stats.log Actions
Feature #728: Add support for OpenCL Actions
Feature #745: Tunnel configuration Actions
Feature #776: rules: Add smtp_envelope and smtp_header keywords Actions
Feature #783: LuaJIT be able to return various messages for a single script. Actions
Feature #816: TCP SACK: limits per stream Actions
Feature #821: conditional logging: output steering Actions
Feature #843: Custom http logging filter functionality Actions
Feature #870: luajit: global vars Actions
Feature #880: memcap http parser Actions
Feature #902: VLAN host table support Actions
Feature #933: add a IPv6 ( RFC2460 recommended order of EH )rule to decoder events rules Actions
Feature #936: support tzsp protocol Actions
Feature #960: persistent TCP resets Actions
Feature #1002: Possible to disabling/bypassing a rule by a specific source ip and a destination ip? Actions
Feature #1015: add chained content info to rule analysis Actions
Feature #1025: seperate #ifdef UNITTEST code into their own files Actions
Feature #1095: Integration of support for STIX-based indicators Actions
Feature #1132: set rpath for libs not in the default linker paths Actions
Feature #1140: IP-Address white list implementation for IPS mode (without disable a rule global) Actions
Feature #1191: EVE log does not support customformat Actions
Feature #1194: Implement http_args keyword to match http arguments - query string or body Actions
Feature #1215: journald logging support Actions
Feature #1234: nfqueue: use mnl API Actions
Feature #1239: Best effort TCP stack Actions
Feature #1245: Add "drop-only" and "alert-only" option for pcap-log Actions
Feature #1247: Using suppress in threshold.config does not prevent dropping Actions
Feature #1250: protocol: Multipath TCP (mptcp) Actions
Feature #1290: handle SIGHUP signal Actions
Feature #1300: profiling: per flow recording of profiling data Actions
Feature #1323: automated eve.json rotation Actions
Feature #1348: OOBE -6- increasing max-pending-packets default value Actions
Feature #1370: sctp fp on suricata engine Actions
Feature #1380: JSON and Unified2 output "payload" does not contain full (or real in the case of Unified2) packets for session Actions
Feature #1389: suppress by host Actions
Feature #1469: Use ISO 8601 date/time formats Actions
Feature #1489: Log a message when memcap limit is reached Actions
Feature #1504: lua: better notification in verbose mode on script errors Actions
Feature #1505: lua: show lua scripts during rule (re)loading Actions
Feature #1541: multi-detect - vlan range mapping Actions
Feature #1566: ICMPv4 control channel detection Actions
Feature #1571: Socket permissions setting in suricata.yaml Actions
Feature #1590: lua: force file magic and md5 lookup from script Actions
Feature #1608: Add option to disable JSON escape slash Actions
Feature #1662: Disable action / rule ordering option Actions
Feature #1710: unix-socket: Send output to unix socket Actions
Feature #1712: multitenancy: 'lite' tenants Actions
Feature #1741: flow: use capture methods flow hash Actions
Feature #1750: Set Suricata to listen to all network interfaces when using AF_PACKET Actions
Feature #1752: Netmap for Windows Actions
Feature #1766: TLS keyword expansion Actions
Feature #1767: Support DTLS protocol Actions
Feature #1783: lua: create buffers to expose L2, L3, and L4 headers Actions
Feature #1794: test suricata rules over unix-socket Actions
Feature #1799: netmap: capture drop stats Actions
Feature #1819: Silent installer for suricata windows Actions
Feature #1872: add --list-decoder-protos or similar Actions
Feature #1899: Detecting Malicious TCP Network Flows Based on Benford’s Law Actions
Feature #1939: Introduce packet/byte counter in stats.log/json for local bypass Actions
Feature #1950: allow configuration of file-store types Actions
Feature #1956: Add option to re-initialise Lua output scripts Actions
Feature #1977: get the os info from TCP HTTP fingerprint Actions
Feature #1995: fast.log should show if packet has been dropped or rejected Actions
Feature #2021: doc: sha256 filesum extraction missing in documentation Actions
Feature #2055: Optionally logging on files.json - Not log every file, only certain files that are stored and extracted Actions
Feature #2092: Improved support for xbits/hostbits - workers runmode Actions
Feature #2107: eve: rotate log output based on size Actions
Feature #2115: Changing interfaces Actions
Feature #2145: Relate directly flowid with certificate file Actions
Feature #2147: fileinfo: sha1 hash not logged if state == TRUNCATED Actions
Feature #2166: output: log only triggering buffers Actions
Feature #2174: Need a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET Actions
Feature #2213: file matching: allow generic file matching / store Actions
Feature #2227: more detailed output about number of threads created Actions
Feature #2232: Allow Large value in suricata.yaml file Actions
Feature #2233: Allow log for payload and packet only for defined sid Actions
Feature #2262: Unix Socket Output Configurable Retries and Blocking Actions
Feature #2269: tls: tls.version: allow negation or comparison Actions
Feature #2273: engine analysis: enable analysis by default during startup Actions
Feature #2277: netinfo: structured information about the network. Output hierarchical network tree in events Actions
Feature #2281: tcp stream: simpler IDS handling of overlap evasions Actions
Feature #2291: traffic-id: ruleset for traffic classification and bypass Actions
Feature #2301: netflow: dump records at interval Actions
Feature #2308: threshold/suppress by http_host Actions
Feature #2310: lua: expose xbits Actions
Feature #2316: global memcap Actions
Feature #2342: Write PCAP files directly to Unix Socket Actions
Feature #2343: Add "flush" command to unix socket Actions
Feature #2371: lua: list all available /exposed fields to lua Actions
Feature #2380: [discussion] deprecate: 'alert syslog' output Actions
Feature #2409: Push signatures without reloading the entire set. Actions
Feature #2410: Create a reset counter and track maximum number of parallel flows Actions
Feature #2426: tls: extend logging Actions
Feature #2488: HTML Parsing / Buffers Actions
Feature #2513: sslproxy: handle HTTP header Actions
Feature #2519: XFF iprep support Actions
Feature #2538: dsize keyword improvements Actions
Feature #2569: multi-tenancy: allow mapping to 'device pair' in IPS mode Actions
Feature #2613: stats: add xdp counters to stats Actions
Feature #2628: Specify the flow direction in metadata sent by Suricata. Actions
Feature #2648: store captured data into file Actions
Feature #2661: output the http-body-data to eve.json Actions
Feature #2672: Split out DHCP parser to be reusable Actions
Feature #2673: Split out DNS parser to be reusable Actions
Feature #2674: Split out NFS parser to be reusable Actions
Feature #2675: Split out SMB parser to be reusable Actions
Feature #2681: Reloading of categories file, IP reputation list during rule live reload Actions
Feature #2700: ja3/ja3s functionality for IKEv2 Actions
Feature #2701: flow: counter for allocations at runtime Actions
Feature #2713: protocol detection w/o protocol parsing Actions
Feature #2727: DCERPC UID to name mapping Actions
Feature #2746: Use Available Instruction Set Specialization (AVX2 and AVX512) in Hyperscan when available Actions
Feature #2755: vendor id / vid keyword to give rulesets unique sid ranges Actions
Feature #2756: rules: input in json format Actions
Feature #2759: iprep: more granularity Actions
Feature #2764: dns logging v1 vs v2 Actions
Feature #2767: Interception of network stack attacks Actions
Feature #2771: MPLS over Vlan support Actions
Feature #2772: Add MPLS labels to alert output Actions
Feature #2818: Napatech Bypass support Actions
Feature #2858: app-layer-protocol:failed; doesn't match traffic with ALPROTO_UNKNOWN Actions
Feature #2860: Suricata doesn't detect part of IKEv2 traffic Actions
Feature #2871: lua: Exposing byte extract to script Actions
Feature #2925: Support for SPB encapsulation Actions
Feature #2931: Perform privdrop without libcap-ng support Actions
Feature #2932: add batman-adv decode support Actions
Feature #2935: Support for multiple-logger for drop eve-log Actions
Feature #2939: Suricata enhancements - proposals Actions
Feature #2957: Suricata x Moloch - protocol detection. Proposals for TLS/SSL Actions
Feature #2962: eve: log more IKEv2 fields Actions
Feature #2987: Suggestions for new keywords (streambits) Actions
Feature #2996: Extend decode events and rules Actions
Feature #3042: stats: allow per second stats updates Actions
Feature #3105: Add kafka output Actions
Feature #3212: Prevent duplicate pcaps from being re-processed Actions
Feature #3244: IMAP Support Actions
Feature #3245: Email extraction to separate folder Actions
Feature #3246: Logging of Email body Actions
Feature #3260: SMTP Base64 Decoding of Message Body Actions
Feature #3261: SMTP quoted-printable Decoding of Message Body Actions
Feature #3271: Add keyword to determine flow based speed/bw Actions
Feature #3290: use config vars everywhere Actions
Feature #3295: unix-socket: support to receive flow bypass information Actions
Feature #3296: Include in the fileinfo if it was a duplicate Actions
Feature #3298: Create a config flag in the DNS logger to limit events to only the ones in the custom field Actions
Feature #3310: ease suricata configuration with xdp Actions
Feature #3311: Add better default suricata configuration for different traffic sizes and cpu/system architectures Actions
Feature #3316: unix-socket: support dumping flow table Actions
Feature #3317: rules: use rust for tokenizing rules Actions
Feature #3319: on 'wrong thread' reinject packets to correct thread Actions
Feature #3321: Evaluate different encoders for eve-log Actions
Feature #3333: Research: Unwind panic's from Rust modules Actions
Feature #3373: add init service file example script for Debian/Ubuntu Actions
Feature #3383: nflog: use mnl api Actions
Feature #3439: bpf-filter does not accept path/file Actions
Feature #3454: Add support to communicate with other networking products Actions
Feature #3494: rules: Keyword for determining if the http_host is an ip address Actions
Feature #3503: decoders: handle trailing data Actions
Feature #3548: Support GTP(GPRS Tunnelling Protocol). Actions
Feature #3629: Publish the Suricata support Python libraries to PyPI (make pip installable) Actions
Feature #3663: DNS: Parse and extract DNS NULL records Actions
Feature #3675: Testimony support Actions
Feature #3688: Re-implement fast_pattern:only; in some way Actions
Feature #3845: Threshold Hit Counter (for SID/IP) Actions
Feature #3848: Keep a Reference to Matched Items in Suricata Datasets for Rule-Writing Actions
Feature #3875: Support multiple XFF Actions
Feature #3894: Option "ttl" exclusive range behavior is non-intuitive Actions
Feature #3950: Suricata bash completion Actions
Feature #3954: Optimize handling of encapsulation in cloud deployment Actions
Feature #3959: Python tool to take ip rules and convert into iprep rule(s) Actions
Feature #3960: Python tool to simulate GAP testing Actions
Feature #4070: capture plugins: receive notification when suricata is done with a packet Actions
Feature #4093: Extend stats log to print packet and byte rate on protocols Actions
Feature #4123: Research: handle different flow tuples in TLS decrypt Actions
Feature #4138: A stable flow ID for dump/restore of state as well as state synchronization Actions
Feature #4147: Map rules to MITRE ATT&CK Actions
Feature #4148: Research: SSH Support for additional protocol analysis Actions
Feature #4149: Research: Dynamic datasets Actions
Feature #4150: Profiling mode: Ticks used to generate an alert available? Actions
Feature #4159: Log flow age as fractional value Actions
Feature #4162: rules: entropy rule keyword Actions
Feature #4172: Split eve.json into multiple files based on alert severity Actions
Feature #4175: dcerpc: higher level logging Actions
Feature #4179: tunnel-Node for flow, netflow and dns-events in eve.json Actions
Feature #4213: smb: higher level logging Actions
Feature #4217: not complete cmd start line does not produce expliccit enough warning or msg Actions
Feature #4227: breakout components of tls.cert_subject and tls.cert_issuer into additional "sub" buffers Actions
Feature #4242: config: support predefined default configuration profiles Actions
Feature #4249: ics protocol: SS7 Protocol Support Actions
Feature #4250: Diameter Protocol Support Actions
Feature #4270: load rules from database Actions
Feature #4279: Optionally allow hashing truncated files, and a maximum length to hash Actions
Feature #4325: xdp compile warnings on 5.4 kernels Actions
Feature #4333: Include the ‘short name’ from classification.config in the all-eve.log Actions
Feature #4381: flowbits: warn if flowbit dependencies don't follow suricata inspection order Actions
Feature #4398: support regex match and flowvars as keywords value Actions
Feature #4408: definitive log count mode for qa purposes Actions
Feature #4547: pcrexform not support tcp and other protocol Actions
Feature #4559: Tags for rules that enables mapping to Mitre Att&ck Actions
Feature #4573: add IPS drop total to eve log output Actions
Feature #4617: Add ThreatFox (by Abuse.ch) to suricata ruleset index Actions
Feature #4649: Autonomous System Number (ASN) support similar to GeoIP Actions
Feature #4758: dns: weird query should have app-layer-event? Actions
Feature #4770: eve: specialized output for ML on packet sizes and similar properties Actions
Feature #4774: rules: analysis output that shows rules per 'progress' value Actions
Feature #4781: config: add command to dump built-in config defaults Actions
Feature #4782: config: add command to dump all active settings Actions
Feature #4840: stats: distinguish between observational stats and performance stats Actions
Feature #4845: IPv6 evasion : parasite6 + dos new ipv6 + fake mldrouter6 advertise Actions
Feature #4951: decode: datalink type 276 not yet supported Actions
Feature #4976: frames: implement/complete profiling support Actions
Feature #4982: frames: selective frame logging Actions
Feature #4985: quic: support frames Actions
Feature #4988: frames: logging improvements Actions
Feature #4989: eve/alert: make frame logging configurable Actions
Feature #5014: Enable suricatasc to use configured command socket by default Actions
Feature #5051: output/frames: allow tx logging to reference frames Actions
Feature #5067: smb/dcerpc: Match dcerpc (over smb) requests before bind_ack Actions
Feature #5069: smb: keyword for matching smb command Actions
Feature #5128: Light weight packet profiling Actions
Feature #5152: Anomaly: CredSSP support addition to Suricata anomaly parsing Actions
Feature #5206: Buffer Dump Utility Actions
Feature #5209: Add "status" mode to Suricata's socket command interface Actions
Feature #5247: Applayer Detect protocol only one direction : RTSP protocol Actions
Feature #5365: Limit rust 'filetracker' memory in configuration Actions
Feature #5372: Add support for encrypted traffic analysis Actions
Feature #5405: Make suricata point to where to report a bug Actions
Feature #5440: multiple stats EVE logs with different intervals Actions
Feature #5450: Rule keyword for non midstream flows Actions
Feature #5461: eve: Use threaded output by default Actions
Feature #5469: rules: expose per flow stream.midstream setting to the rule language Actions
Feature #5470: reject: allow reject dev to be specified in the yaml Actions
Feature #5499: PCAP-over-IP client Actions
Feature #5618: setup-app-layer: add option to choose TCP/UDP protocol Actions
Feature #5641: dns: frame based keywords for "raw" fields in requests and responses Actions
Feature #5648: flowworker: heuristic to see how busy a thread is with elephant flows Actions
Feature #5649: eve.flow: add thread id(s) processing a flow to the record Actions
Feature #5650: unix socket: query threads about most recent elephant flows Actions
Feature #5655: host: make memuse and memcap reached counters for host table Actions
Feature #5657: byte_test: allow comparison with static value Actions
Feature #5668: eve: optionally add rule fast_pattern Actions
Feature #5670: Support wide strings somehow Actions
Feature #5673: capture: option to decapsulate everything first Actions
Feature #5674: Support layered protocols Actions
Feature #5675: protocol: MMS SCADA support Actions
Feature #5676: ASN1 Spec to Rust nom generator Actions
Feature #5677: protocol: BGP support Actions
Feature #5681: datasets: add more transform layers to match on domains Actions
Feature #5687: eve: "auth" and/or "auth_fail" log Actions
Feature #5705: protocol: Wireguard parser Actions
Feature #5716: rdp: add app-layer frame support Actions
Feature #5727: krb: add frame support Actions
Feature #5728: modbus: add frame support Actions
Feature #5729: bittorrent-dht: add frame support Actions
Feature #5730: dhcp: add frame support Actions
Feature #5732: ntp: add frame support Actions
Feature #5733: snmp: add frame support Actions
Feature #5737: smtp body extract Actions
Feature #5745: exceptions: allow setting via unix-socket Actions
Feature #5752: Proposed new DNP3 keywords and operators Actions
Feature #5764: logging: add a format string for a more standard log format Actions
Feature #5774: Addressing Mixed Case in HTTP Headers Names and HTTP2 Actions
Feature #5776: PCRE fast_patterns via hyperscan Actions
Feature #5798: New transformation: dropbytes Actions
Feature #5872: file structure awareness - precise identification of fields in file structs Actions
Feature #5894: file: file classification keyword Actions
Feature #5913: rfb: add more record types Actions
Feature #5956: Report traffic with missing VLAN tag Actions
Feature #6004: Add retry option to redis outputs using a socket instead of IP Actions
Feature #6012: dpdk: add support for segmented mbufs Actions
Feature #6051: app-layer: dhcpv6 support Actions
Feature #6067: Add field to track SID of Flowbit Matches Actions
Feature #6101: icap: app-layer protocol support Actions
Feature #6102: Translate NAT64 ranges (also custom ranges) Actions
Feature #6198: smtp: add keywords for use in rules Actions
Feature #6200: output: suricata.yaml dump-all-headers applied for alerts Actions
Feature #6206: Investigate a more intuitive use of the timestamp field in traffic/metadata events Actions
Feature #6251: AF-XDP ability to bind custom program Actions
Feature #6268: Recognize related ICMP request/response pairs Actions
Feature #6295: output: add stream-size to flow output Actions
Feature #6296: smtp: BDAT chunking support incl MIME parsing Actions
Feature #6373: main/startup: support sentinel file signal for initial rule processing completion Actions
Feature #6410: Log packets/bytes per second in Suricata stats Actions
Feature #6453: Support DNS over TLS Actions
Feature #6456: output: binary logging Actions
Feature #6457: eve: configurable list of fields in output Actions
Feature #6461: ics protocol: bacnet Actions
Feature #6462: ics protocol: IEC104 Protocol Support Actions
Feature #6464: protocol: profibus Actions
Feature #6465: multi-tenant: support vxlan as a selector Actions
Feature #6466: multi-tenant: support mpls as a selector Actions
Feature #6467: flow tracking: add other parameters to flow tracking Actions
Feature #6468: flow-tracking: add geneve as a flow tracking parameter Actions
Feature #6469: flow-tracking: add erspan as a flow tracking parameter Actions
Feature #6470: flow-tracking: add vxlan as a flow tracking parameter Actions
Feature #6471: flow-tracking: add mpls as a tracking parameter Actions
Feature #6482: Deployment: detect if capture is good enough Actions
Feature #6625: Apply netflow per network Actions
Feature #6649: Add a keyword to match on raw data within headers especially for protocols without a dedicated parser Actions
Feature #6650: dns: support extended response/error codes Actions
Feature #6683: stats: add packet time elapsed indicator Actions
Feature #6692: Have keywords export JSON dump function for engine analysis Actions
Feature #6701: Auto-bypass optimization Actions
Feature #6779: http.header_names behavior when encountering duplicate header names Actions
Feature #6794: Tie signature to live device in IPS mode Actions
Feature #6802: Support Domain rollup using existing dataset library Actions
Feature #6807: Support the use of variables within transforms Actions
Feature #6808: Quantify how a Suricata rule matches against a PCAP Actions
Feature #6823: SC_WARN_POOR_RULE on to_lowercase/to_uppercase transformation with non-possible matching content Actions
Feature #6853: Support of variables from byte_math / byte_extract in bsize / dsize comparisons Actions
Feature #6885: references: new "wayback" reference and update others Actions
Feature #6914: support inspecting http.uri or http.request_body Actions
Feature #6916: decoding : add support of IEEE 802.2, 802.3 frames Actions
Feature #6922: Have a way to manually request decompression/inflate if headers are not present Actions
Feature #6925: multi-buffer support for HTTP cookies Actions
Feature #6926: rules: new buffer that includes HTTP headers and the start of HTTP body Actions
Feature #6993: rule macros for commonly used logic in rules Actions
Feature #6995: raw option for http.request/response_header Actions
Feature #7052: Add facility to move data from code into data files Actions
Feature #7056: version info not reported in stats json Actions
Feature #7057: monitored interface information in stats json Actions
Feature #7082: redis: support EVE output to a Redis stream Actions
Feature #7095: rdp: keywords additions Actions
Feature #7096: detect/flow: additions to time detection Actions
Feature #7097: Additions to flow detection - size Actions
Feature #7099: Addition of total bytes to the flow logs Actions
Feature #7100: smb: additional keywords Actions
Feature #7101: eve: add number of flowbits in protocol records and alerts Actions
Feature #7103: ssh: extra fields and keywords Actions
Feature #7114: from_base64: allow matching on decode error Actions
Feature #7127: extended http.referer buffers/keywords Actions
Feature #7129: decode: Create a decode event for unknown ethertypes Actions
Feature #7132: threshold: add thresholding options for all decode events Actions
Feature #7146: decode: Create a decode event for unknown IP types Actions
Feature #7175: Response module API Actions
Feature #7221: Sanity checking on IP network prefix base addresses Actions
Feature #7283: installing suricatasc functionality without installing suricata entirely Actions
Feature #7321: rules: cross buffer byte_* keyword support Actions
Feature #7328: detect: use hyper scan streaming mode Actions
Feature #7364: deciphering https traffic from linux system Actions
Feature #7384: vlan: flowID should take MPLS into consideration Actions
Feature #7400: eve: optionally support logging pcap output file Actions
Feature #7402: tls: ability to detect self signed certs Actions
Feature #7446: add logic to parse QUIC CRYPTO frames and provide a keyword to access the reassembled data Actions
Feature #7518: add "blocking" argument to pcap-file socket command Actions
Feature #7535: detect/ldap: add ldap.search_request.filter and also log the filter Actions
Feature #7550: detect/ldap: add keywords for LDAP ExtendedResponse Actions
Feature #7559: Allow rule comment at end of rule line using # Actions
Feature #7572: Relative offset support for the entropy keyword Actions
Feature #7594: mime: add email.status keyword Actions
Feature #7621: rules: add lua extension or function Actions
Feature #7654: detect: rule keywords for matching on file hashes Actions
Feature #7655: Allow using flow id in pcap log file name Actions
Feature #7675: Custom content detection Actions
Feature #7679: output/log: log the entropy value Actions
Feature #7696: output: configuration for simple loggers, and reuse in alerts Actions
Feature #7697: firewall: allow request/response action scopes Actions
Feature #7700: firewall: make verdict fields in alert and drop mandatory Actions
Feature #7701: firewall: configurable default policies Actions
Feature #7704: firewall: allow single packet rule to accept tcp connection Actions
Feature #7705: firewall: allow single rule to accept protocol detection in progress and the final protocol Actions
Feature #7706: firewall: default settings; locked settings Actions
Feature #7729: Ability to use local fqdns (to get ipv4 and/or ipv6) in address-groups vars Actions
Feature #7756: windows: add support to reload rules Actions
Feature #7757: windows: add support for log rotation Actions
Feature #7785: pcap-log: support packet context for conditional alerts Actions
Feature #7796: Support for TLS decryption in pcap mode using sslkeylog file Actions
Feature #7844: websocket: add option to log payloads in Eve websocket events Actions
Feature #7882: icmp malware channel activity events in one sided flows Actions
Feature #7888: eve: add app_proto to all event_type Actions
Feature #7895: Identify tunnel parent flow ID in flow logs Actions
Feature #7896: Report stream/socket bytes transferred in flow logs Actions
Feature #7949: affinity: evaluate verbal and relative definition of CPU sets Actions
Feature #7951: (Feature Request) Ability to reference content matches across buffers. Actions
Feature #7970: tls: Log elliptic curve ID Actions
Feature #7971: tls: log state history Actions
Feature #8019: mpm: support `endswith` condition to the fast pattern in hyperscan Actions
Feature #8124: datasets: support subnets Actions
Feature #8132: Add decompression support to pcap-file capture method Actions
Feature #8133: Relative pcre with negative distance to previous content match Actions
Feature #8204: firewall: support for hot reload of firewall mode rules Actions
Feature #8221: http: header handling should treat duplicates as multi-buffer, not concat Actions
Feature #8245: Add payload-only-classtypes filter for EVE alert payload extraction Actions
Feature #8246: af-packet: allow specifying IPS mode on the commandline Actions
Feature #8277: rules: add negation support for ipopts keyword Actions
Feature #8286: output/flush: Improve flushing coverage Actions
Documentation #595: document csum keywords Actions
Documentation #1233: Documentation for each keyword in stats.log file. Actions
Documentation #1691: Docs: Convert windows docs Actions
Documentation #1892: rule docs should include example rules Actions
Documentation #1974: DNP3: document lua support Actions
Documentation #2016: doc: improve keywords self documentation Actions
Documentation #2266: no documentation for file-store-waldo Actions
Documentation #2404: Windows Installation Guide for Suricata bug Actions
Documentation #2470: document content inspection in chunks Actions
Documentation #2585: document replace keyword Actions
Documentation #2588: document hostbits keyword Actions
Documentation #2589: document decode-event Actions
Documentation #2699: document all eve record types and fields Actions
Documentation #2918: Unable to mmap, error Resource temporarily unavailable - err seems OS specific Actions
Documentation #2976: review userguide from beginners point of view Actions
Documentation #3018: No documentation for "flowvar" keyword Actions
Documentation #3019: No documentation for "pktvar" keyword Actions
Documentation #3022: No documentation for "nfq_set_mark" keyword Actions
Documentation #3023: No documentation for "bsize" keyword Actions
Documentation #3025: Missing docs for "http." keywords Actions
Documentation #3027: No documentation for "nfs" keywords Actions
Documentation #3031: No documentation for "asn1" keyword Actions
Documentation #3032: No documentation for "engine-event" keyword Actions
Documentation #3033: document: "stream-event" keyword Actions
Documentation #3034: No documentation for "l3_proto" keyword Actions
Documentation #3035: No docs for "base64_" keywords Actions
Documentation #3036: No documentation for "template2" keyword Actions
Documentation #3046: Document each default value from the config file Actions
Documentation #3180: tracking: document all decoder and app-layer events Actions
Documentation #3181: document http engine events Actions
Documentation #3222: userguide: improve guidance on ipv6 configuration Actions
Documentation #3268: Add links to additional information at the wiki to the userguide Actions
Documentation #3274: doc: some inconsistency between http docs keywords description Actions
Documentation #3303: Add a documentation about the used sid and gid ranges Actions
Documentation #3313: Document 40Gbps IPS set up Actions
Documentation #3748: Add documentation for flags keyword Actions
Documentation #3751: Alert metadata JSON configs in suricata.yaml.in should match the RTD documentation Actions
Documentation #3762: update documentation for user modes Actions
Documentation #4662: Add documentation section covering Suricata rule grammar Actions
Documentation #4706: Guide for rulewriting Actions
Documentation #4743: Improve Suricata code documentation (C files) Actions
Documentation #4768: DNS v2 EVE does not longer contain `dns.rdata` but it is still listed in the documentation Actions
Documentation #5068: nfs: document rule keyword Actions
Documentation #5182: userguide: better document rule keywords Actions
Documentation #5225: testing/fuzz: improve documentation on how to fuzz suricata Actions
Documentation #5359: userguide: improve documentation on (main) EVE fields Actions
Documentation #5367: byte_test: all examples in doc missing a required argument Actions
Documentation #5484: userguide: explain content modifiers usage with regards to position usage in the rule Actions
Documentation #5487: userguide: add explanation on how depth of inspection affects rules Actions
Documentation #5514: userguide: document exception policy from an extreme profiling and tuning perspective Actions
Documentation #5523: userguide: document the tcp-stream keyword Actions
Documentation #5537: devguide: add section/chapter about how [capture] bypassing works for Suricata Actions
Documentation #5591: devguide: bring section about OpenBSD Installation from git into devguide Actions
Documentation #5620: doc: add vectorscan instructions Actions
Documentation #5660: userguide: add (more) documentation for the GRE protocol Actions
Documentation #5662: Review/Update Hyperscan Documentation Actions
Documentation #5669: Better link together the bits keywords Actions
Documentation #5724: Why does reject-dev option work only in Sniff Mode Actions
Documentation #5772: docs: A wrong rule matching example provided by the official doc Actions
Documentation #5837: Unify documentation of command-line parameters Actions
Documentation #5841: tracker: bring documentation from old wiki on redmine to readthedocs guides Actions
Documentation #5842: userguide: bring session about Suricata installation from Ubuntu PPA Actions
Documentation #5995: userguide: ips upgrade guide Actions
Documentation #6059: docs: fix build failure - urllib3 issue Actions
Documentation #6071: eve/schema: add descriptions to the schema Actions
Documentation #6072: eve/schema: document smb Actions
Documentation #6073: eve/schema: document dns Actions
Documentation #6074: eve/schema: document nfs Actions
Documentation #6077: eve/schema: document sip Actions
Documentation #6133: tracking: security deployment documentation Actions
Documentation #6150: doc: improve the file-store documentation for the eve output and the dedicated section Actions
Documentation #6361: userguide: add note about severity<-> priority on alert section Actions
Documentation #6386: Add tls.cert_chain_len Documentation Actions
Documentation #6404: flow.reason value is misleading? Actions
Documentation #6478: schema: add missing fields Actions
Documentation #6694: placement of bitmask note about right shift behavior Actions
Documentation #6924: replicate http.cookie behavior from "Differences From Snort" to http.cookie Actions
Documentation #6982: offset: no documentation that offset can be a name Actions
Documentation #6991: add note about case sensitivity to flowbits docs Actions
Documentation #6992: Document normalization of header name/value separator Actions
Documentation #7145: userguide: update legacy keyword mentions to new ones Actions
Documentation #7217: userguide: add config section on reading pcap-files Actions
Documentation #7220: guides: add a post on using 'ip' and 'tcpdump' to Suricata forum's Guides Actions
Documentation #7222: userguide: document decoder events Actions
Documentation #7223: document 'stream-event' keyword Actions
Documentation #7237: userguide: default's to latest development branch instead of latest release tag Actions
Documentation #7244: userguide: explain multi-tenant default config Actions
Documentation #7298: schema/netflow: add missing field Actions
Documentation #7299: eve/schema: document tls Actions
Documentation #7355: Non working signatures in filestore explanation Actions
Documentation #7385: userguide/redmine: have some instructions for bug reports Actions
Documentation #7386: userguide: list which config fields are updated w/ rule reload Actions
Documentation #7395: engine/analysis: document the output for user friendliness Actions
Documentation #7396: userguide: standardize rst formatting for chapters Actions
Documentation #7545: userguide: document user mode and system mode and their relation to the log directory Actions
Documentation #7573: Clarify which buffers affect subsequent PCRE Actions
Documentation #7770: json schema : extend to describe how a log field matches to a keyword in complex cases Actions
Documentation #7806: Keywords missing documentation Actions
Documentation #7833: Complete list of commands supported by suricatasc Actions
Documentation #7897: doc: byte_test missing documentation for bitmask option Actions
Documentation #8018: datasets: a rule using "load" can use an absolute or relative filename Actions
Documentation #8236: byte_math: fails to list valid values Actions
Documentation #8283: flow: better documenation and guidance for recyclers and managers Actions
Security #5851: rust: handle allocation failures Actions
Security #7966: Relevance of QA UBSan article Actions
Security #8143: Misalligned access to ip header data. Actions

Suricata-Update - TBD

open

To be determined

15%

40 issues   (6 closed — 34 open)

Related issues
Suricata-Update - Feature #2256: Generate a report and log it to a file. Actions
Suricata-Update - Feature #2509: Add support to have more than one condition to match a rule Actions
Suricata-Update - Feature #2630: Suricata Update for Windows Actions
Suricata-Update - Feature #2659: Define the output rules file name. Actions
Suricata-Update - Feature #2938: Add a "show-defaults" command Actions
Suricata-Update - Feature #3202: classtypes: validate classtypes in use Actions
Suricata-Update - Feature #3289: option to verify 'better' standard/schema Actions
Suricata-Update - Feature #3721: Add iprep compatibility Actions
Suricata-Update - Feature #4355: Easy way to disable all engine provided rules. Actions
Suricata-Update - Feature #4481: list-sources: list locally added sources, and make it clear they are local sources Actions
Suricata-Update - Feature #6131: threshold.conf: reconcile current threshold.conf with current state of rules Actions
Suricata-Update - Feature #6202: Resolve xbits dependencies Actions
Suricata-Update - Documentation #3038: documentation: Setup directories with correct permissions Actions
Suricata-Update - Documentation #5376: Add documentation about updating referenced auxiliary files with Suricata-Update Actions
Suricata-Update - Documentation #7138: "Permission denied" when trying to add and update new ruleset Actions

git main

locked

No issues for this version