Open Information Security Foundation

02/05/2024

12:57 PM Suricata Bug #6735 (New): setting variables with --set leads to segfault

Trying to incorrectly set threading 'threads' count leads to a segfault before suricata starts. This was done in 8 bu... Corey Thomas

12/11/2023

11:10 AM Suricata Bug #6619 (Closed): Profiling takes much longer to run than it used to

While trying to profile for something else, I noticed that profiling in 7.x.x+ takes longer compared to 6.x.x builds.... Corey Thomas

11/13/2023

03:18 PM Suricata Bug #6490 (New): Rule profiling log appends path to log directory

While testing rule profiling I noticed that a filename-path of */dev/null* will get appended to the log directory and... Corey Thomas

09/25/2023

03:40 PM Suricata Feature #4573 (Resolved): add IPS drop total to eve log output

Jeff Lucovsky wrote in #note-6:
> @cthomas Does the eve stats addition meet your needs?
Yes, I think so. We have ... Corey Thomas

11/10/2021

03:21 PM Suricata Task #4814: GitHub: Add Fedora 35 builder to GitHub CI

https://github.com/OISF/suricata/pull/6595 Corey Thomas

09/13/2021

12:46 PM Suricata Bug #4672: PR 6336 QA alert deviation

Neither have I. Alerts that show up in only baseline and only test run have the same type of rules (to_server and som... Corey Thomas

09/10/2021

04:33 PM Suricata Bug #4672 (Closed): PR 6336 QA alert deviation

Git master had a low alert deviation that happened between QA rebases.
Running against our SURI_TLPR1 test and rev... Corey Thomas

08/03/2021

01:52 PM Suricata Feature #4573 (Rejected): add IPS drop total to eve log output

It would be useful to have the stats metric for *total IPS drops* in eve output. Probably similar to the alert count ... Corey Thomas

04/30/2021

06:35 PM Suricata Bug #4434: Duplicate alert record in eve log when using unix-socket mode

Looks like that PR generates a single alert for `input.pcap`. Corey Thomas

04/19/2021

08:55 PM Suricata Bug #4434: Duplicate alert record in eve log when using unix-socket mode

Can confirm that 6.0.2 and latest both have a duplicate alert(s) in eve.json when using unix-socket to read the supp... Corey Thomas