Open Information Security Foundation

11/17/2014

10:27 AM Suricata Feature #1317: Lua: Indicator for end of flow

I've tested this feature for my use cases and it works great. Open and close variables are both flagged appropriatel... Paul Gofran

11/14/2014

11:43 AM Suricata Feature #1317 (Closed): Lua: Indicator for end of flow

When using the Lua output feature to stream data, it would be beneficial if Lua was aware when a flow has ended, or w... Paul Gofran

09/25/2014

11:48 AM Suricata Bug #1287 (Closed): Lua Output has dependency on eve-log:http

When using the lua-output feature and specifying:
needs["protocol"] = "http"
In the Lua script, eve-log:http must... Paul Gofran

09/10/2014

05:57 PM Suricata Bug #1273 (Closed): Lua - http.request_line not working

When specifying in the init function of a Lua script:
needs["http.request_line"] = tostring(true)
The match funct... Paul Gofran

08/15/2014

09:29 AM Suricata Feature #1261: Request for Additional Lua Capabilities

Moved #2 and #3 to features #1263 and #1264 respectively. Paul Gofran

09:27 AM Suricata Feature #1263: Lua: Access to Stream Payloads

Correction: This is a feature request, not a bug. Similar features are #1261 and #1264 Paul Gofran

09:23 AM Suricata Feature #1263 (Closed): Lua: Access to Stream Payloads

This is a request to enhance the Lua capabilities:
Access to stream payloads, not just packet payloads. This would b... Paul Gofran

09:25 AM Suricata Feature #1264 (Closed): Lua: access to TCP quad / Flow Tuple

This is a request to provide lua scripts access to the TCP quad. When extracting payloads (ex: needs["payload"]), Lua... Paul Gofran

08/13/2014

04:06 PM Suricata Feature #1261 (Closed): Request for Additional Lua Capabilities

We use the luajit capabilities for various tasks but have hit some limitiations. We’re interesting in making additio... Paul Gofran

06/09/2014

04:36 PM Suricata Bug #1204 (Closed): EVE syslog config parameters (identity, facility, level) do not work

The YAML configuration parameters for eve-log syslog are not taking effect (the default is always used).
ex:
- ... Paul Gofran