The IPS documentation for Windows has a dead link to a PDF. The Windows build instructions should be updated with WinDivert build instructions, and then this link could be updated.Ambre Iooss
Currently Suricata implements the @R@ PCRE modifier to allow the equivalent of @distance:0@. This is enough in most use case, except when using PCRE extraction. See for example this rule:Ambre Iooss
Suricata can produce pcap.xz files, but can only read uncompressed pcap files. When dealing with large datasets of pcap, it can be useful to be able to load them directly in Suricata without having to decompress them beforehand.Ambre Iooss
Currently `SCWebSocketLoggerLog` hardcodes `pp` and `pb64` as `false`. An user can only dumps websocket payloads with an alert (setting `websocket-payload: yes`). An option could be added in `suricata.yaml`, such as `outputs.1.eve-lo...Ambre Iooss
During an attack-defense CTF, I captured the following exchange between a Python HTTPX client and an ASP.NET server (behing a NGINX reverse-proxy).Ambre Iooss
The rule engine is buggy when using hyperscan. This can be reproduced on a fresh Ubuntu 24.04 install, with the same Suricata package, and same firewall configuration. The Suricata rules are:Ambre Iooss