Open Information Security Foundation

08/06/2025

10:37 PM Suricata Feature #6456: output: binary logging

Ion could be a candidate that could coexist well with the existing JSON outputs: https://amazon-ion.github.io/ion-doc... Jamie Lavigne

09:38 PM Suricata Feature #7103: ssh: extra fields and keywords

Searchable keyword: protolog Jamie Lavigne

09:06 PM Suricata Bug #2091: nonexistent/misspelled custom fields accepted during parsing of suricata.yaml

Erroring explicitly would definitely be a good thing for usability - if it's an invalid input then getting that feedb... Jamie Lavigne

05/15/2025

08:07 PM Suricata Feature #7704: firewall: allow single packet rule to accept tcp connection

The idea behind this one is to statefully accept the flow at layer 3/4 with a single directional rule, but not quite ... Jamie Lavigne

05/09/2025

05:42 PM Suricata Feature #7699: firewall: separate stats for ips and firewall

I think that last one would be great, that groups all firewall drops together and breaks out rules from default polic... Jamie Lavigne

11/14/2024

02:14 PM Suricata Bug #7392: Verdict output reports "drop" when rejected

This one was reported to me by an internal user but I think the motivations are both philosophical and practical.
... Jamie Lavigne

11/13/2024

01:21 PM Suricata Bug #7392 (New): Verdict output reports "drop" when rejected

When a rule with reject action matches and resets a connection, the verdict action reported is not "reject" but inste... Jamie Lavigne

08/15/2024

09:07 PM Suricata Bug #7216 (Feedback): drop_reason counters don't support tunneled connections

Suricata 7 introduces useful new drop_reason stats counters, but the actual drop reasons aren't reflected in the coun... Jamie Lavigne

07/03/2024

10:02 PM Suricata Bug #7133 (Feedback): Could the midstream policy support "drop-packet"?

One small challenge we have encountered during the upgrade from Suricata 6 to 7 is that the midstream policy's "drop-... Jamie Lavigne

05/28/2024

09:36 PM Suricata Feature #6063: exception-policy: stream async policy

It's important for this feature to include flow logs (or similar) visibility so that users can use the source & dest ... Jamie Lavigne