suricata
detect-threshold.h
Go to the documentation of this file.
1
/* Copyright (C) 2007-2024 Open Information Security Foundation
2
*
3
* You can copy, redistribute or modify this Program under the terms of
4
* the GNU General Public License version 2 as published by the Free
5
* Software Foundation.
6
*
7
* This program is distributed in the hope that it will be useful,
8
* but WITHOUT ANY WARRANTY; without even the implied warranty of
9
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
* GNU General Public License for more details.
11
*
12
* You should have received a copy of the GNU General Public License
13
* version 2 along with this program; if not, write to the Free Software
14
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
* 02110-1301, USA.
16
*/
17
18
/**
19
* \file
20
*
21
* \author Breno Silva <breno.silva@gmail.com>
22
*/
23
24
#ifndef SURICATA_DETECT_THRESHOLD_H
25
#define SURICATA_DETECT_THRESHOLD_H
26
27
#define TYPE_LIMIT 1
28
#define TYPE_BOTH 2
29
#define TYPE_THRESHOLD 3
30
#define TYPE_DETECTION 4
31
#define TYPE_RATE 5
32
#define TYPE_SUPPRESS 6
33
#define TYPE_BACKOFF 7
34
35
#define TRACK_DST 1
36
#define TRACK_SRC 2
37
#define TRACK_RULE 3
38
#define TRACK_EITHER 4
/**< either src or dst: only used by suppress */
39
#define TRACK_BOTH 5
/* used by rate_filter to match detections by both src and dst addresses */
40
#define TRACK_FLOW 6
/**< track by flow */
41
42
/* Get the new action to take */
43
#define TH_ACTION_ALERT 0x01
44
#define TH_ACTION_DROP 0x02
45
#define TH_ACTION_PASS 0x04
46
#define TH_ACTION_LOG 0x08
47
#define TH_ACTION_SDROP 0x10
48
#define TH_ACTION_REJECT 0x20
49
50
/**
51
* \typedef DetectThresholdData
52
* A typedef for DetectThresholdData_
53
*/
54
55
typedef
struct
DetectThresholdData_
{
56
uint32_t
count
;
/**< Event count */
57
uint32_t
seconds
;
/**< Event seconds */
58
uint8_t
type
;
/**< Threshold type : limit , threshold, both, detection_filter */
59
uint8_t
track
;
/**< Track type: by_src, by_dst */
60
uint8_t
new_action
;
/**< new_action alert|drop|pass|log|sdrop|reject */
61
uint32_t
timeout
;
/**< timeout */
62
uint32_t
flags
;
/**< flags used to set option */
63
uint32_t
multiplier
;
/**< backoff multiplier */
64
DetectAddressHead
addrs
;
65
}
DetectThresholdData
;
66
67
/**
68
* Registration function for threshold: keyword
69
*/
70
71
void
DetectThresholdRegister
(
void
);
72
DetectThresholdData
*
DetectThresholdDataCopy
(
DetectThresholdData
*);
73
74
#endif
/*SURICATA_DETECT_THRESHOLD_H */
DetectThresholdData_::timeout
uint32_t timeout
Definition:
detect-threshold.h:61
DetectAddressHead_
Definition:
detect.h:180
DetectThresholdData_::count
uint32_t count
Definition:
detect-threshold.h:56
DetectThresholdRegister
void DetectThresholdRegister(void)
Registration function for threshold: keyword.
Definition:
detect-threshold.c:86
DetectThresholdData_::new_action
uint8_t new_action
Definition:
detect-threshold.h:60
DetectThresholdData_::multiplier
uint32_t multiplier
Definition:
detect-threshold.h:63
DetectThresholdData_::type
uint8_t type
Definition:
detect-threshold.h:58
DetectThresholdDataCopy
DetectThresholdData * DetectThresholdDataCopy(DetectThresholdData *)
Make a deep-copy of an extant DetectTHresholdData object.
Definition:
detect-threshold.c:343
DetectThresholdData_::track
uint8_t track
Definition:
detect-threshold.h:59
DetectThresholdData_
Definition:
detect-threshold.h:55
DetectThresholdData_::flags
uint32_t flags
Definition:
detect-threshold.h:62
DetectThresholdData
struct DetectThresholdData_ DetectThresholdData
DetectThresholdData_::seconds
uint32_t seconds
Definition:
detect-threshold.h:57
DetectThresholdData_::addrs
DetectAddressHead addrs
Definition:
detect-threshold.h:64
src
detect-threshold.h
Generated on Sat Dec 21 2024 23:30:33 for suricata by
1.8.18