Actions
Documentation #6924
openreplicate http.cookie behavior from "Differences From Snort" to http.cookie
Affected Versions:
Effort:
Difficulty:
Label:
Description
this section/note of http.cookie behavior only exists with the "differences from snort" section of docs
https://docs.suricata.io/en/latest/rules/differences-from-snort.html#http-cookie-buffer
If a request contains multiple "Cookie" or "Set-Cookie" headers, the values will be concatenated in the Suricata http_cookie buffer, in the order seen from top to bottom, with a comma and space (", ") between each of them.
Other keywords that exhibit the same behavior have notes on them within the keyword specific section (https://docs.suricata.io/en/latest/rules/http-keywords.html#http-header-and-http-header-raw)
Updated by Brandon Murphy 26 days ago
- Subject changed from replicate http.cookie behavior document in "Differences From Snort" to http.cookie doc to replicate http.cookie behavior from "Differences From Snort" to http.cookie
Updated by Jason Taylor 7 days ago
- Status changed from New to In Progress
- Assignee changed from OISF Dev to Jason Taylor
This should be addressed with https://github.com/OISF/suricata/pull/10937
will this work for what you wanted updated?
Actions