Suricata

Background¶

Feature #4783 added support for fully qualified configuration keys in YAML configuration files and includes. For example:

vars.address-groups.HOME_NET: "[192.0.2.0/24]" 

This addresses the same configuration node as:

vars:
  address-groups:
    HOME_NET: "[192.0.2.0/24]" 

Another valid example using the Suricata configuration is:

app-layer.protocols.smtp.mime.body-md5: yes

This behavior was implemented by PR #8439 but is not documented in the user guide. The existing documentation only demonstrates dotted configuration paths with the command-line --set option.

Dotted keys are particularly useful in configuration include or override files because they update a specific leaf without removing sibling settings such as EXTERNAL_NET or other application-layer protocol settings.