Documentation #3025
closedDocumentation #5182: userguide: better document rule keywords
Missing docs for "http." keywords
Description
The docs still cover the usage and examples of the deprecated keywords "http_cookie" and "http_method" but there is no mention that they have been replaced by "http.cookie" and "http.method" respectively.
Updated by Shivani Bhardwaj over 5 years ago
- Subject changed from Missing docs for "http.cookie" and "http.method" to Missing docs for "http." keywords
Updated by Shivani Bhardwaj over 5 years ago
Shivani Bhardwaj wrote:
The docs still cover the usage and examples of the deprecated keywords "http_cookie" and "http_method" but there is no mention that they have been replaced by "http.cookie" and "http.method" respectively.
Turns out this is the case with a lot of "http." keywords. List below:
Keyword Replaced by ======== =========== http_cookie http.cookie http_method http.method http_client_body http.request_body http_server_body http.response_body http_header http.header http_raw_header http.header.raw http_uri http.uri http_raw_uri http.uri.raw http_stat_code http.stat_code http_user_agent http.user_agent http_host http.host http_raw_host http.host.raw
Updated by Andreas Herz over 5 years ago
- Assignee set to OISF Dev
- Target version set to TBD
Updated by Andreas Herz about 5 years ago
- Tracker changed from Task to Documentation
Updated by Juliana Fajardini Reichow almost 2 years ago
- Status changed from New to In Progress
- Assignee changed from OISF Dev to Jason Taylor
Updated by Jason Taylor 11 months ago
A discussion had here,https://github.com/OISF/suricata/pull/9509
It seems that a general revisit of the http-keywords.rst page is in order to remove confusing formatting/notations and generally update to remove legacy keywords since Suricata 4 is EOL.
Updated by Jason Taylor 6 months ago
this was completed in https://github.com/OISF/suricata/pull/10735