Project

General

Profile

Actions
Copy link

Documentation #1892

open
VJ CT

rule docs should include example rules

Documentation #1892: rule docs should include example rules

Added by Victor Julien over 9 years ago. Updated over 1 year ago.

Status:
New
Priority:
Normal
Assignee:
Community Ticket
Target version:
TBD
Affected Versions:
Effort:
high
Difficulty:
low
Label:
Beginner, Outreachy

Description

Think it would be nice to add example rules for each rule keyword. Perhaps a minimal example and a real world one from the ETOpen set.

Related issues 1 (1 open — 0 closed)

Related to Suricata - Documentation #4706: Guide for rulewritingNewCommunity TicketActions

PM Updated by Peter Manev over 9 years ago Actions
Copy link
 #1

It think it will also be a good idea to make that part of the PR process (as well) where such a PR introduces new or updates keywords.
Otherwise the "how to" for new or updated keywords is not visible to the rulewriters or end users.

Easier said than done I suppose - it would be ideal if we can maybe have something like -

suricata --list-keywords-examples

where each listed keyword can have an example rule.
Maybe we could reuse a good part of the unittests to help out with that ?

AH Updated by Andreas Herz over 9 years ago Actions
Copy link
 #2

Wouldn't be such a list quite verbose? Maybe we can first add it to the docs and relate to them with the --list-keywords-examples?

VJ Updated by Victor Julien almost 8 years ago Actions
Copy link
 #3

  • Effort set to high
  • Difficulty set to low

I'm open to both. I also think it would be a nice idea to have per rule keyword manpages, based on the user docs. Like how for example git commands have their own manpages. These manpages should then have one or more example rules.

VJ Updated by Victor Julien almost 8 years ago Actions
Copy link
 #4

  • Assignee deleted (OISF Dev)

VJ Updated by Victor Julien almost 8 years ago Actions
Copy link
 #5

I've set effort to high as there are many keywords, but this can be a step-by-step thing. So per keyword effort is low.

VJ Updated by Victor Julien about 7 years ago Actions
Copy link
 #6

  • Assignee set to Community Ticket
  • Label Beginner added

VJ Updated by Victor Julien about 7 years ago Actions
Copy link
 #7

  • Target version changed from Documentation to TBD

AH Updated by Andreas Herz over 6 years ago Actions
Copy link
 #8

  • Tracker changed from Feature to Documentation

JF Updated by Juliana Fajardini Reichow over 4 years ago Actions
Copy link
 #9

JF Updated by Juliana Fajardini Reichow over 1 year ago Actions
Copy link
 #10

  • Label Outreachy added

If you are an Outreachy applicant and would like to work on this issue, please check our documentation docs.suricata.io for a rule keyword that doesn't have examples, and discuss with us if it would be a good candidate for this task :)

Actions
Copy link

Also available in: PDF Atom