suricata/rules
Victor Julien 45500acdc4 tls: implement alert parser
Fatal alerts set the tx state to 'finished'.

Add event for malformed alerts.
2025-03-21 07:08:57 +01:00
..
app-layer-events.rules app-layer: protocol change API 2017-05-08 10:43:36 +02:00
decoder-events.rules af-packet: add event for packets truncated by af-packet 2025-03-18 11:02:32 +01:00
dhcp-events.rules dhcp: add dhcp app-layer rules file 2018-06-16 06:42:28 -06:00
dnp3-events.rules rules: add missing classtypes for event.rules 2017-06-01 07:38:26 +02:00
dns-events.rules dns: improved handling of corrupt additionals 2025-01-10 09:16:34 +01:00
enip-events.rules enip: convert to rust 2024-06-07 13:54:22 +02:00
files.rules rules: spelling 2023-05-06 14:50:43 +02:00
ftp-events.rules ftp: add events for command too long 2023-01-26 15:51:54 +01:00
http-events.rules http: have a headers limit 2024-09-25 10:42:48 +02:00
http2-events.rules doh2: really enforce 65K dns message limit 2024-12-20 07:55:54 +01:00
ipsec-events.rules rules/ike: fix ike event names that have changed 2024-11-05 11:40:00 +01:00
kerberos-events.rules Kerberos 5: rename weak crypto to weak encryption, and log it 2018-06-13 10:25:40 +02:00
Makefile.am enip: convert to rust 2024-06-07 13:54:22 +02:00
modbus-events.rules rules/modbus: remove rule for event that not longer exists 2024-11-05 11:40:00 +01:00
mqtt-events.rules mqtt: raise event on parse error 2022-04-08 22:58:27 +02:00
nfs-events.rules nfs: limits the number of active transactions per flow 2022-02-16 14:24:37 +01:00
ntp-events.rules Add event rules for NTP events 2017-06-27 16:52:23 +02:00
pgsql-events.rules pgsql: add events 2025-02-19 09:21:37 +01:00
quic-events.rules quic: handle fragmented hello over multiple packets 2025-02-19 16:34:12 +01:00
README.md pgsql: add events 2025-02-19 09:21:37 +01:00
rfb-events.rules rfb: never return error on unknown traffic 2023-06-27 09:44:59 +02:00
smb-events.rules smb: checks against nbss records length 2023-02-10 18:04:20 +01:00
smtp-events.rules smtp/events: set direction on rules 2025-03-10 12:23:08 +01:00
ssh-events.rules rules: add SSH decoder events rules 2020-05-22 08:40:01 +02:00
stream-events.rules stream: add TCP urgent handling options 2024-12-11 14:50:39 +01:00
tls-events.rules tls: implement alert parser 2025-03-21 07:08:57 +01:00
websocket-events.rules app-layer: websockets protocol support 2024-04-17 07:17:02 +02:00

Suricata Reserved SID Allocations

Unless otherwise noted, each component or protocol is allocated 1000 signature IDs.

Components

Component Start End
Decoder 2200000 2200999
Stream 2210000 2210999
Generic App-Layer 2260000 2260999

App-Layer Protocols

Protocol Start End
SMTP 2220000 2220999
HTTP 2221000 2221999
NTP 2222000 2222999
NFS 2223000 2223999
IPsec 2224000 2224999
SMB 2225000 2225999
Kerberos 2226000 2226999
DHCP 2227000 2227999
SSH 2228000 2228999
MQTT 2229000 2229999
TLS 2230000 2230999
QUIC 2231000 2231999
FTP 2232000 2232999
DNS 2240000 2240999
PGSQL 2241000 2241999
MODBUS 2250000 2250999
DNP3 2270000 2270999
HTTP2 2290000 2290999