Project

General

Profile

Actions

Feature #5639

open

Allow dataset to match on extracted domain

Added by Eric Leblond about 1 year ago.

Status:
In Review
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

When matching on tls.sni or http.host, it is convenient to match on the domain name inside the value instead of matching on the full value. If endswith can be used for one domain in one signature using dataset would be more useful.


Related issues 1 (1 open0 closed)

Related to Suricata - Feature #5681: datasets: add more transform layers to match on domainsNewOISF DevActions
Actions #1

Updated by Victor Julien about 1 year ago

  • Related to Feature #5681: datasets: add more transform layers to match on domains added
Actions

Also available in: Atom PDF