Actions
Documentation #6924
closed
BM
JT
replicate http.cookie behavior from "Differences From Snort" to http.cookie
Documentation #6924:
replicate http.cookie behavior from "Differences From Snort" to http.cookie
Affected Versions:
Effort:
Difficulty:
Label:
Description
this section/note of http.cookie behavior only exists with the "differences from snort" section of docs
https://docs.suricata.io/en/latest/rules/differences-from-snort.html#http-cookie-buffer
If a request contains multiple "Cookie" or "Set-Cookie" headers, the values will be concatenated in the Suricata http_cookie buffer, in the order seen from top to bottom, with a comma and space (", ") between each of them.
Other keywords that exhibit the same behavior have notes on them within the keyword specific section (https://docs.suricata.io/en/latest/rules/http-keywords.html#http-header-and-http-header-raw)
BM Updated by Brandon Murphy about 2 years ago
- Status changed from In Progress to New
BM Updated by Brandon Murphy about 2 years ago
- Subject changed from replicate http.cookie behavior document in "Differences From Snort" to http.cookie doc to replicate http.cookie behavior from "Differences From Snort" to http.cookie
JT Updated by Jason Taylor almost 2 years ago
- Status changed from New to In Progress
- Assignee changed from OISF Dev to Jason Taylor
This should be addressed with https://github.com/OISF/suricata/pull/10937
will this work for what you wanted updated?
JT Updated by Jason Taylor almost 2 years ago
- Status changed from In Progress to Closed
This was addressed in https://github.com/OISF/suricata/pull/11027 as part of https://redmine.openinfosecfoundation.org/issues/6781
Actions