Project

General

Profile

Actions

Documentation #6924

closed

replicate http.cookie behavior from "Differences From Snort" to http.cookie

Added by Brandon Murphy about 1 month ago. Updated 14 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

this section/note of http.cookie behavior only exists with the "differences from snort" section of docs

https://docs.suricata.io/en/latest/rules/differences-from-snort.html#http-cookie-buffer

If a request contains multiple "Cookie" or "Set-Cookie" headers, the values will be concatenated in the Suricata http_cookie buffer, in the order seen from top to bottom, with a comma and space (", ") between each of them.

Other keywords that exhibit the same behavior have notes on them within the keyword specific section (https://docs.suricata.io/en/latest/rules/http-keywords.html#http-header-and-http-header-raw)

Actions #1

Updated by Brandon Murphy about 1 month ago

  • Status changed from In Progress to New
Actions #2

Updated by Brandon Murphy about 1 month ago

  • Subject changed from replicate http.cookie behavior document in "Differences From Snort" to http.cookie doc to replicate http.cookie behavior from "Differences From Snort" to http.cookie
Actions #3

Updated by Jason Taylor 25 days ago

  • Status changed from New to In Progress
  • Assignee changed from OISF Dev to Jason Taylor

This should be addressed with https://github.com/OISF/suricata/pull/10937

will this work for what you wanted updated?

Actions #4

Updated by Jason Taylor 14 days ago

  • Status changed from In Progress to Closed
Actions

Also available in: Atom PDF