Merge pull request elastic#219 from Logrhythm/2.4.2

2.4.2

protofiles/Applications.proto

@@ -2325,4 +2325,29 @@ optional string wsop = 2323 [default = "Mobile game."];
 optional string zendesk = 2324 [default = "Zendesk is a cloud-based customer service platform that includes ticketing self-service options and customer support features."];
 optional string magicjack = 2325 [default = "MagicJack is a VoIP service for home and business use available as a mobile application and also with a proprietary device (magicJack PLUS)."];
 optional string adobe = 2326 [default = "Adobe Systems is a computer software company. It develops graphic designer software and Andio and Video editing and visual effects. This plug-in classifies traffic to the website."];
+optional string carbonite = 2327 [default = "This signature detects Carbonite a service that manages online backups."];
+optional string _5pmweb = 2328 [default = "5pmweb is a web-based project and task management software for teams."];
+optional string yodiz = 2329 [default = "Yodiz is online Agile Project Management tool consisting of Product Backlog Management Kanban Scrum Board Issue Tracking Software Team Discussions and issues."];
+optional string inneractive = 2330 [default = "Inneractive is a monetizer for cross-platform mobile applications."];
+optional string sabameeting = 2331 [default = "Saba Meeting is a web conferencing and desktop sharing service."];
+optional string qoo10 = 2332 [default = "Singaporian online fashion and trend shopping market."];
+optional string digitalriver = 2333 [default = "Digital River is a public company that provides internet commerce services."];
+optional string tigerair = 2334 [default = "Singaporian online travel agency."];
+optional string naver_blog = 2335 [default = "Naver Blog is a South Korean blog hosting website."];
+optional string egloos = 2336 [default = "Egloos is a South Korean blog hosting website."];
+optional string teltel = 2337 [default = "VOIP software which allows calling other teltel users."];
+optional string flurry = 2338 [default = "Flurry provides services to optimize customer's mobile experience through apps and personalized ads."];
+optional string sgcarmart = 2339 [default = "Singaporean online car market."];
+optional string samsung = 2340 [default = "Samsung is a South Korean multinational company."];
+optional string goplan = 2341 [default = "Goplan is an online project management and collaboration tool for individuals and teams."];
+optional string golden_village = 2342 [default = "Singaporian online cinema ticket booking."];
+optional string jobsdb = 2343 [default = "Job seeking website."];
+optional string wrike = 2344 [default = "Wrike is web based project management software that gives you full visibility and control over your projects."];
+optional string zuji = 2345 [default = "Singaporean online travel agency."];
+optional string mailru_agent = 2346 [default = "Mail.ru Agent is a cross-platform mobile messaging application supporting text audio and video. It is featured by Mail.ru."];
+optional string toggle = 2347 [default = "Singaporian video streaming website."];
+optional string nate_mail = 2348 [default = "Nate Mail is a South Korea webmail."];
+optional string hungrygowhere = 2349 [default = "Singaporean fooding website."];
+optional string crittercism = 2350 [default = "Crittercism is a mobile application for performance management."];
+optional string dhcp6 = 2351 [default = "The DHCPv6 protocol is used to automatically configure the network parameters of a station in an IPv6 network."];
 }

protofiles/DpiMsgLRproto.proto

@@ -2699,8 +2699,14 @@ optional uint32 sr_dlsrQ_PROTO_RTCP = 3007; // QOSMOS:Q_PROTO_RTCP,Q_RTCP_SR_DLS
 optional string mapped_address_ipv4Q_PROTO_STUN = 3008; // QOSMOS:Q_PROTO_STUN,Q_STUN_MAPPED_ADDRESS_IPV4,uint32,ip_addrToString
 optional string xor_mapped_address_ipv4Q_PROTO_STUN = 3009; // QOSMOS:Q_PROTO_STUN,Q_STUN_XOR_MAPPED_ADDRESS_IPV4,uint32,ip_addrToString
 optional string framed_ip_netmaskQ_PROTO_RADIUS = 3010; // QOSMOS:Q_PROTO_RADIUS,Q_RADIUS_FRAMED_IP_NETMASK,uint32,ip_addrToString
-optional uint32 magic_cookieQ_PROTO_STUN = 3011; // QOSMOS:Q_PROTO_STUN,Q_STUN_MAGIC_COOKIE
-repeated bytes conference_idQ_PROTO_YMSG = 3012; // QOSMOS:Q_PROTO_YMSG,Q_YMSG_CONFERENCE_ID
-repeated bytes video_typeQ_PROTO_YOUTUBE = 3013; // QOSMOS:Q_PROTO_YOUTUBE,Q_MPA_VIDEO_TYPE
 optional uint32 video_avgdatarateQ_PROTO_YOUTUBE = 3014; // QOSMOS:Q_PROTO_YOUTUBE,Q_MPA_VIDEO_AVGDATARATE
+repeated bytes file_idQ_PROTO_MAILRU_AGENT = 3015; // QOSMOS:Q_PROTO_MAILRU_AGENT,Q_MAILRU_AGENT_FILE_ID
+repeated bytes msg_receiverQ_PROTO_MAILRU_AGENT = 3016; // QOSMOS:Q_PROTO_MAILRU_AGENT,Q_MAILRU_AGENT_MSG_RECEIVER
+repeated bytes msgQ_PROTO_MAILRU_AGENT = 3017; // QOSMOS:Q_PROTO_MAILRU_AGENT,Q_MAILRU_AGENT_MSG
+repeated bytes conference_idQ_PROTO_MAILRU_AGENT = 3018; // QOSMOS:Q_PROTO_MAILRU_AGENT,Q_MAILRU_AGENT_CONFERENCE_ID
+repeated bytes im_actionQ_PROTO_MAILRU_AGENT = 3019; // QOSMOS:Q_PROTO_MAILRU_AGENT,Q_MAILRU_AGENT_IM_ACTION
+repeated bytes userQ_PROTO_MAILRU_AGENT = 3020; // QOSMOS:Q_PROTO_MAILRU_AGENT,Q_MAILRU_AGENT_USER
+optional uint32 magic_cookieQ_PROTO_STUN = 3021; // QOSMOS:Q_PROTO_STUN,Q_STUN_MAGIC_COOKIE
+repeated bytes conference_idQ_PROTO_YMSG = 3022; // QOSMOS:Q_PROTO_YMSG,Q_YMSG_CONFERENCE_ID
+repeated bytes video_typeQ_PROTO_YOUTUBE = 3023; // QOSMOS:Q_PROTO_YOUTUBE,Q_MPA_VIDEO_TYPE
 }

resources/Applications.csv

@@ -2318,3 +2318,28 @@ wsop,2323,"Mobile game."
 zendesk,2324,"Zendesk is a cloud-based customer service platform that includes ticketing self-service options and customer support features."
 magicjack,2325,"MagicJack is a VoIP service for home and business use available as a mobile application and also with a proprietary device (magicJack PLUS)."
 adobe,2326,"Adobe Systems is a computer software company. It develops graphic designer software and Andio and Video editing and visual effects. This plug-in classifies traffic to the website."
+carbonite,2327,"This signature detects Carbonite a service that manages online backups."
+_5pmweb,2328,"5pmweb is a web-based project and task management software for teams."
+yodiz,2329,"Yodiz is online Agile Project Management tool consisting of Product Backlog Management Kanban Scrum Board Issue Tracking Software Team Discussions and issues."
+inneractive,2330,"Inneractive is a monetizer for cross-platform mobile applications."
+sabameeting,2331,"Saba Meeting is a web conferencing and desktop sharing service."
+qoo10,2332,"Singaporian online fashion and trend shopping market."
+digitalriver,2333,"Digital River is a public company that provides internet commerce services."
+tigerair,2334,"Singaporian online travel agency."
+naver_blog,2335,"Naver Blog is a South Korean blog hosting website."
+egloos,2336,"Egloos is a South Korean blog hosting website."
+teltel,2337,"VOIP software which allows calling other teltel users."
+flurry,2338,"Flurry provides services to optimize customer's mobile experience through apps and personalized ads."
+sgcarmart,2339,"Singaporean online car market."
+samsung,2340,"Samsung is a South Korean multinational company."
+goplan,2341,"Goplan is an online project management and collaboration tool for individuals and teams."
+golden_village,2342,"Singaporian online cinema ticket booking."
+jobsdb,2343,"Job seeking website."
+wrike,2344,"Wrike is web based project management software that gives you full visibility and control over your projects."
+zuji,2345,"Singaporean online travel agency."
+mailru_agent,2346,"Mail.ru Agent is a cross-platform mobile messaging application supporting text audio and video. It is featured by Mail.ru."
+toggle,2347,"Singaporian video streaming website."
+nate_mail,2348,"Nate Mail is a South Korea webmail."
+hungrygowhere,2349,"Singaporean fooding website."
+crittercism,2350,"Crittercism is a mobile application for performance management."
+dhcp6,2351,"The DHCPv6 protocol is used to automatically configure the network parameters of a station in an IPv6 network."

resources/NetMonFieldNames.csv

@@ -1275,6 +1275,12 @@ MAILRU,senderQ_PROTO_MAILRU,sender,Sender,Sender,sender,<sender>,Sender,,1st Rev
 MAILRU,sender_aliasQ_PROTO_MAILRU,sender_alias,SenderAlias,Sender Alias,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
 MAILRU,sender_emailQ_PROTO_MAILRU,sender_email,SenderEmail,Sender Email,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
 MAILRU,subjectQ_PROTO_MAILRU,subject,Subject,Subject,subject,<subject>,Subject,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+MAILRU_AGENT,file_idQ_PROTO_MAILRU_AGENT,file_id,FileId,File Id,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+MAILRU_AGENT,msg_receiverQ_PROTO_MAILRU_AGENT,msg_receiver,MsgReceiver,Msg Receiver,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+MAILRU_AGENT,msgQ_PROTO_MAILRU_AGENT,msg,Msg,Message,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+MAILRU_AGENT,conference_idQ_PROTO_MAILRU_AGENT,conference_id,ConferenceId,Conference Id,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+MAILRU_AGENT,im_actionQ_PROTO_MAILRU_AGENT,im_action,IMAction,IM Action,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+MAILRU_AGENT,userQ_PROTO_MAILRU_AGENT,user,User,User,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
 MAKTOOB,actionQ_PROTO_MAKTOOB,action,Action,Action,command,<command>,Command,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
 MAKTOOB,attach_idQ_PROTO_MAKTOOB,attach_id,AttachID,Attach ID,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
 MAKTOOB,attach_sizeQ_PROTO_MAKTOOB,attach_size,AttachSize,Attach Size,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

resources/ProtocolDescriptions.csv

@@ -177,7 +177,7 @@ s1ap,S1 Application Protocol,#ep_value_raw,Elementary Procedure raw value.
 s1ap,S1 Application Protocol,#ep_ie_value_raw,Information Element raw value.
 sccp,Skinny Client Control Protocol,#inherit_parent,"Parent inheritance key
 secondlife,SecondLife.com,#login_id,Id of virtual character.
-secondlife,SecondLife.com,#sender,Sender Id.
+secondlife,SecondLife.com,#sender,Contains the identity of the sender of a chat session or a file transfer.
 secondlife,SecondLife.com,#source_id,Source Id.
 secondlife,SecondLife.com,#session_id,Uniquely identifies the current user session.
 sip,Session Initiation Protocol,#inherit_key,"Candidate inheritance key

resources/ProtocolFilters

@@ -2,7 +2,7 @@
 !NA,NA|
 !Q_IP_SRC_ADDR32|
 !buffer|
-!,,,,,|
+!,\.,,,,,|
 !binary|
 !Q_IP_DST_ADDR32|
 !Q_BASE_DELAY|