Open Information Security Foundation

04/22/2024

07:52 PM Suricata Feature #6802: Support Domain rollup using existing dataset library

Hello François, what is your final goal ? Is the domain keyword like implemented in https://github.com/OISF/suricata/... Eric Leblond

04/20/2024

06:57 AM Suricata Bug #6969 (In Progress): Dataset lookup function is not working with ip type

When checking if an IPv4 address is in an IPv4/IPv6 set, we always obtain the result that it is not even if it is pre... Eric Leblond

02/17/2024

11:10 PM Suricata Feature #5639: Allow dataset to match on extracted domain

We stopped the discussion on which crate to use:
- https://crates.io/crates/publicsuffix
- https://crates.io/crates... Eric Leblond

01/18/2024

04:23 PM Suricata Bug #6692 (In Progress): Have keywords export JSON dump function for engine analysis

Engine analysis is dumping really interesting information about keywords usage in signature so it is interesting to e... Eric Leblond

12/14/2023

09:19 PM Suricata Bug #6634: Invalid ja3 due to double client hello

PR https://github.com/OISF/suricata/pull/10059 Eric Leblond

09:11 PM Suricata Bug #6634 (In Progress): Invalid ja3 due to double client hello

Stamus Networks team has discovered some weird TLS connections happening in real networks. These connections are not ... Eric Leblond

11/18/2023

09:11 PM Suricata Bug #6551 (Closed): Invalid registration of prefiltering in stream size

Eric Leblond

11:03 AM Suricata Feature #6550 (In Review): Capability to have rules profiling on pcap run

As rules profiling is activated via the unix socket, it is not possible to use it in pcap run. By adding an option to... Eric Leblond

10/15/2023

01:49 PM Suricata Bug #6405: Ethernet src should match src ip

I pushed an implementation that seems to fix the issue there: https://github.com/OISF/suricata/commit/d5fe84abd7d0329... Eric Leblond

10/14/2023

07:10 PM Suricata Bug #6405: Ethernet src should match src ip

Sascha Steinbiss wrote in #note-2:
> I'm not really sure what you mean by "ethernet IP addresses". AFAICS many packe... Eric Leblond