Project

General

Profile

Actions

Documentation #3025

closed

Documentation #5182: userguide: better document rule keywords

Missing docs for "http." keywords

Added by Shivani Bhardwaj over 5 years ago. Updated 6 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

The docs still cover the usage and examples of the deprecated keywords "http_cookie" and "http_method" but there is no mention that they have been replaced by "http.cookie" and "http.method" respectively.

Actions #1

Updated by Shivani Bhardwaj over 5 years ago

  • Subject changed from Missing docs for "http.cookie" and "http.method" to Missing docs for "http." keywords
Actions #2

Updated by Shivani Bhardwaj over 5 years ago

Shivani Bhardwaj wrote:

The docs still cover the usage and examples of the deprecated keywords "http_cookie" and "http_method" but there is no mention that they have been replaced by "http.cookie" and "http.method" respectively.

Turns out this is the case with a lot of "http." keywords. List below:

Keyword                    Replaced by
========                 ===========
http_cookie               http.cookie
http_method            http.method
http_client_body      http.request_body
http_server_body    http.response_body
http_header             http.header
http_raw_header     http.header.raw
http_uri                     http.uri
http_raw_uri             http.uri.raw
http_stat_code         http.stat_code
http_user_agent      http.user_agent
http_host                  http.host
http_raw_host          http.host.raw

Actions #3

Updated by Andreas Herz over 5 years ago

  • Assignee set to OISF Dev
  • Target version set to TBD
Actions #4

Updated by Andreas Herz about 5 years ago

  • Tracker changed from Task to Documentation
Actions #5

Updated by Juliana Fajardini Reichow about 2 years ago

  • Parent task set to #5182
Actions #6

Updated by Juliana Fajardini Reichow almost 2 years ago

  • Status changed from New to In Progress
  • Assignee changed from OISF Dev to Jason Taylor
Actions #7

Updated by Jason Taylor 11 months ago

A discussion had here,https://github.com/OISF/suricata/pull/9509

It seems that a general revisit of the http-keywords.rst page is in order to remove confusing formatting/notations and generally update to remove legacy keywords since Suricata 4 is EOL.

Actions #8

Updated by Jason Taylor 6 months ago

Actions #9

Updated by Jason Taylor 6 months ago

  • Status changed from In Progress to Closed
Actions

Also available in: Atom PDF