display syntax requirement on keyword parsing error
Currently if the syntax of a rule keyword is wrong we print just a pcre error most of the times.
It would be good to have a string per keyword that is displayed on error.
threshold: type <threshold|limit|both>, track <by_src|by_dst>, count <N>, seconds <T>
Updated by Jason Taylor 11 months ago
It looks like the last discussion that was had around this was in https://github.com/OISF/suricata/pull/4251. Are there any update thoughts or ideas around this? I was going to take another look at this but wanted to see if anyone else had or was.