Project

General

Profile

Actions

Documentation #5182

open

userguide: better document rule keywords

Added by Juliana Fajardini Reichow 7 months ago. Updated 10 days ago.

Status:
New
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

This could probably become more than just one ticket.
The motivation behind it is that there are many rule keywords
that are mentioned but lack proper explanation on what they are/
how they related to what is seen on the wire.
Example: dzise (https://suricata.readthedocs.io/en/latest/rules/payload-keywords.html#dsize)

Improving that would be great.


Subtasks 17 (16 open1 closed)

Documentation #2588: document hostbits keywordNewOISF DevActions
Documentation #3015: Missing documentation for "tag" keywordNewOISF DevActions
Documentation #3018: No documentation for "flowvar" keywordNewOISF DevActions
Documentation #3025: Missing docs for "http." keywordsNewOISF DevActions
Documentation #3028: No documentation for "pkt_data" keywordNewOISF DevActions
Documentation #3030: doc: document for "smb" keywordsIn ReviewEric LeblondActions
Documentation #3031: No documentation for "asn1" keywordNewOISF DevActions
Documentation #3033: No documentation for "stream-event" keywordNewOISF DevActions
Documentation #3034: No documentation for "l3_proto" keywordNewOISF DevActions
Documentation #3036: No documentation for "template2" keywordNewOISF DevActions
Documentation #3748: Add documentation for flags keywordNewActions
Documentation #5068: nfs: document rule keywordNewJuliana Fajardini ReichowActions
Documentation #5088: file.name sticky buffer is not documentedNewOISF DevActions
Documentation #5385: userguide: update rule's format documentClosedJason TaylorActions
Documentation #5485: userguide: explain that the http.header_names buffer is normalizedNewOISF DevActions
Documentation #5519: userguide: update 'dsize' examples and documentationIn ReviewJason TaylorActions
Documentation #5523: userguide: document the tcp-stream keywordNewOISF DevActions
Actions

Also available in: Atom PDF