aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

doc: fix rules

Browse Source 
Ticket: 8372

Somes rules in the doc had typos, fix them so suricata can load
them when you copy/paste the doc
pull/15217/head
Philippe Antoine 3 months ago committed by Victor Julien
parent 42a85c37f1
commit 15f45be672
10 changed files with 60 additions and 13 deletions
Show Stats Download Patch File Download Diff File

2
doc/userguide/lua/libs/dns.rst
Unescape Escape View File

@ -31,7 +31,7 @@ transaction state. Available states are ``request_complete`` and
.. container:: example-rule
alert dns::example-rule-emphasis:`request_complete` any any -> any any (...
alert dns::example-rule-emphasis:`request_complete` any any -> any any (sid: 1;)
Then to initialize the script::

2
doc/userguide/lua/libs/ssh.rst
Unescape Escape View File

@ -22,7 +22,7 @@ For example:
.. container:: example-rule
alert ssh::example-rule-emphasis:`response_banner_done` any any -> any any (...
alert ssh::example-rule-emphasis:`response_banner_done` any any -> any any (sid: 1;)
Setup
^^^^^

24
doc/userguide/rules/http-keywords.rst
Unescape Escape View File

@ -122,7 +122,7 @@ Example Duplicate HTTP Header::
.. container:: example-rule
alert http $HOME_NET -> $EXTERNAL_NET (msg:"Example Duplicate Header"; \
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Example Duplicate Header"; \
flow:established,to_server; :example-rule-options:`http.user_agent; \
content:"Mozilla/5.0, Chrome/121.0.0";` classtype:bad-unknown; sid:103; \
rev:1;)
@ -612,10 +612,14 @@ and show the different ``urilen`` options.
flow:established,to_server; :example-rule-options:`urilen:>10;` \
classtype:bad-unknown; sid:41; rev:1;)
.. container:: example-rule
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urilen less than 12"; \
flow:established,to_server; :example-rule-options:`urilen:<12;` \
classtype:bad-unknown; sid:42; rev:1;)
.. container:: example-rule
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urilen greater/less than \
example"; flow:established,to_server; :example-rule-options:`urilen:10<>12;` \
classtype:bad-unknown; sid:43; rev:1;)
@ -964,6 +968,8 @@ Example HTTP Response::
Example"; flow:established,to_server; :example-rule-options:`http.content_len; \
content:"100";` bsize:3; classtype:bad-unknown; sid:97; rev:1;)
.. container:: example-rule
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"HTTP Content-Length Response \
Example"; flow:established,to_client; :example-rule-options:`http.content_len; \
content:"20";` bsize:2; classtype:bad-unknown; sid:98; rev:1;)
@ -1017,6 +1023,8 @@ Example HTTP Response::
content:"multipart/form-data|3b 20|";` startswith; classtype:bad-unknown; \
sid:95; rev:1;)
.. container:: example-rule
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"HTTP Content-Type Response \
Example"; flow:established,to_client; :example-rule-options:`http.content_type; \
content:"text/html";` bsize:9; classtype:bad-unknown; sid:96; rev:1;)
@ -1050,7 +1058,7 @@ Example HTTP Request::
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP Cookie Example"; \
flow:established,to_server; :example-rule-emphasis:`http.cookie; \
content:"PHPSESSIONID=123";` bsize:14; classtype:bad-unknown; sid:80; rev:1;)
content:"PHPSESSIONID=123";` bsize:16; classtype:bad-unknown; sid:80; rev:1;)
.. note:: Cookies are passed in HTTP headers but Suricata extracts the cookie
data to ``http.cookie`` and will not match cookie content put in the
@ -1100,11 +1108,15 @@ Example HTTP Request::
content:"User-Agent|3a 20|Mozilla/5.0|0d 0a|";` classtype:bad-unknown; \
sid:70; rev:1;)
.. container:: example-rule
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP Header Example 2"; \
flow:established,to_server; :example-rule-options:`http.header; \
content:"Host|3a 20|suricata.io|0d 0a|";` classtype:bad-unknown; \
sid:71; rev:1;)
.. container:: example-rule
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP Header Example 3"; \
flow:established,to_server; :example-rule-options:`http.header; \
content:"User-Agent|3a 20|Mozilla/5.0|0d 0a|"; startswith; \
@ -1176,6 +1188,8 @@ Examples to match exactly on header order:
content:"|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|";` bsize:22; \
classtype:bad-unknown; sid:110; rev:1;)
.. container:: example-rule
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"HTTP Header Names Response \
Example"; flow:established,to_client; :example-rule-options:`http.header_names; \
content:"|0d 0a|Content-Type|0d 0a|Server|0d 0a 0d a0|";` bsize:26; \
@ -1189,6 +1203,8 @@ Examples to match on header existence:
Example 2"; flow:established,to_server; :example-rule-options:`http.header_names; \
content:"|0d 0a|Host|0d 0a|";` classtype:bad-unknown; sid:112; rev:1;)
.. container:: example-rule
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"HTTP Header Names Response \
Example 2"; flow:established,to_client; :example-rule-options:`http.header_names; \
content:"|0d 0a|Content-Type|0d 0a|";` classtype:bad-unknown; sid:113; rev:1;)
@ -1201,6 +1217,8 @@ Examples to match on header absence:
Example 3"; flow:established,to_server; :example-rule-options:`http.header_names; \
content:!"|0d 0a|User-Agent|0d 0a|";` classtype:bad-unknown; sid:114; rev:1;)
.. container:: example-rule
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"HTTP Header Names Response \
Example 3"; flow:established,to_client; :example-rule-options:`http.header_names; \
content:!"|0d 0a|Date|0d 0a|";` classtype:bad-unknown; sid:115; rev:1;)
@ -1280,6 +1298,8 @@ Example HTTP Response::
content:"POST / HTTP/1.1|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|";` \
classtype:bad-unknown; sid:101; rev:1;)
.. container:: example-rule
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"HTTP Start Response \
Example"; flow:established,to_client; :example-rule-options:`http.start; \
content:"HTTP/1.1 200 OK|0d 0a|Content-Type|0d 0a|Server|0d 0a 0d a0|";` \

6
doc/userguide/rules/intro.rst
Unescape Escape View File

@ -347,7 +347,7 @@ This rule cannot have the ``fast_pattern`` to client, as ``file.data`` is a stre
.. container:: example-rule
alert http any any => any any (file.data: to_server; content: "123"; http.stat_code; content: "500"; fast_patten;)
alert http any any => any any (file.data: to_server; content: "123"; http.stat_code; content: "500"; fast_pattern; sid: 1;)
If not explicit, a transactional rule will choose a fast_pattern to server by default.
@ -405,6 +405,8 @@ The following rules demonstrate ``noalert`` with a familiar pattern:
:example-rule-action:`alert` :example-rule-header:`http any any -> $HOME_NET any` :example-rule-options:`(msg:"noalert example: set state"; flow:established,to_server; xbits:set,SC.EXAMPLE,track ip_dst, expire 10; noalert; http.method; content:"GET"; sid:1; )`
.. container:: example-rule
:example-rule-action:`alert` :example-rule-header:`http any any -> $HOME_NET any` :example-rule-options:`(msg:"noalert example: state use"; flow:established,to_server; xbits:isset,SC.EXAMPLE,track ip_dst; http.method; content:"POST"; sid: 2; )`
In IPS mode, ``noalert`` is commonly used in when Suricata should `drop` network packets
@ -413,7 +415,7 @@ showing how ``noalert`` could be used with IPS deployments to drop inbound SSH r
.. container:: example-rule
:example-rule-action:`drop` :example-rule-header:`tcp any any -> any 22` :example-rule-options:`(msg:"Drop inbound SSH traffic"; noalert; sid: 3)`
:example-rule-action:`drop` :example-rule-header:`tcp any any -> any 22` :example-rule-options:`(msg:"Drop inbound SSH traffic"; noalert; sid: 3;)`
.. _rules-modifiers:

2
doc/userguide/rules/meta.rst
Unescape Escape View File

@ -118,7 +118,7 @@ has no technical implications, the value is only noted in alert data.
Example of the gid value in an alert entry in the fast.log file.
In the part [1:123], the first 1 is the gid (123 is the sid and 1 is the rev).
.. container:: example-rule
.. note::
07/12/2022-21:59:26.713297 [**] [:example-rule-emphasis:`1`:123:1] HTTP GET Request Containing Rule in URI [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 192.168.225.121:12407 -> 172.16.105.84:80

6
doc/userguide/rules/multi-buffer-matching.rst
Unescape Escape View File

@ -15,7 +15,7 @@ Example rule:
.. container:: example-rule
`alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"DNS Multiple Question Example Rule"; dns.query; content:"example"; dns.query; content:".com"; classtype:misc-activity; sid:1; rev:1;)`
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"DNS Multiple Question Example Rule"; dns.query; content:"example"; dns.query; content:".com"; classtype:misc-activity; sid:1; rev:1;)
Within the single DNS query transaction, there are two queries
and Suricata will set up two instances of a dns.query buffer.
@ -32,7 +32,7 @@ new functionality would look like:
.. container:: example-rule
`alert http2 any any -> any any (msg:"HTTP2 Multiple Header Buffer Example"; flow:established,to_server; http.request_header; content:"method|3a 20|GET"; http.request_header; content:"authority|3a 20|example.com"; classtype:misc-activity; sid:1; rev:1;)`
alert http2 any any -> any any (msg:"HTTP2 Multiple Header Buffer Example"; flow:established,to_server; http.request_header; content:"method|3a 20|GET"; http.request_header; content:"authority|3a 20|example.com"; classtype:misc-activity; sid:1; rev:1;)
With HTTP2 there are multiple headers seen in the same flow record.
We now have a way to write a rule in a more efficient way using the
@ -45,7 +45,7 @@ Example rule:
.. container:: example-rule
`alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"DNS Query Sticky Buffer Classic Example Rule"; dns.query; content:"example"; content:".net"; classtype:misc-activity; sid:1; rev:1;)`
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"DNS Query Sticky Buffer Classic Example Rule"; dns.query; content:"example"; content:".net"; classtype:misc-activity; sid:1; rev:1;)
The above rule will alert on a single dns query containing
"example.net" or "example.domain.net" since the rule content

4
doc/userguide/rules/noalert.rst
Unescape Escape View File

@ -17,7 +17,7 @@ A rule that specifies ``noalert`` will not generate an alert when it matches, bu
.. container:: example-rule
alert http any any -> any any (http.user_agent; content:"Mozilla/5.0"; startwith; endswith; \
alert http any any -> any any (http.user_agent; content:"Mozilla/5.0"; startswith; endswith; \
flowbits:set,mozilla-ua; :example-rule-options:`noalert;` sid:1;)
This example sets a flowbit "mozilla-ua" on matching, but does not generate an alert due to the presence of ``noalert``.
@ -33,7 +33,7 @@ This keyword can be used to implement an "alert then pass"-logic.
.. container:: example-rule
pass http any any -> any any (http.user_agent; content:"Mozilla/5.0"; startwith; endswith; \
pass http any any -> any any (http.user_agent; content:"Mozilla/5.0"; startswith; endswith; \
:example-rule-options:`alert;` sid:1;)
This example would pass the rest of the HTTP flow with the Mozilla/5.0 user-agent, generating an alert for the "pass" event.

22
doc/userguide/rules/payload-keywords.rst
Unescape Escape View File

@ -386,14 +386,24 @@ Examples of ``bsize`` in a rule:
alert dns any any -> any any (msg:"bsize exact buffer size"; dns.query; content:"google.com"; bsize:10; sid:1; rev:1;)
.. container:: example-rule
alert dns any any -> any any (msg:"bsize less than value"; dns.query; content:"google.com"; bsize:<25; sid:2; rev:1;)
.. container:: example-rule
alert dns any any -> any any (msg:"bsize buffer less than or equal value"; dns.query; content:"google.com"; bsize:<=20; sid:3; rev:1;)
.. container:: example-rule
alert dns any any -> any any (msg:"bsize buffer greater than value"; dns.query; content:"google.com"; bsize:>8; sid:4; rev:1;)
.. container:: example-rule
alert dns any any -> any any (msg:"bsize buffer greater than or equal value"; dns.query; content:"google.com"; bsize:>=8; sid:5; rev:1;)
.. container:: example-rule
alert dns any any -> any any (msg:"bsize buffer range value"; dns.query; content:"google.com"; bsize:8<>20; sid:6; rev:1;)
@ -435,16 +445,28 @@ Examples of dsize values:
alert tcp any any -> any any (msg:"dsize exact size"; dsize:10; sid:1; rev:1;)
.. container:: example-rule
alert tcp any any -> any any (msg:"dsize less than value"; dsize:<10; sid:2; rev:1;)
.. container:: example-rule
alert tcp any any -> any any (msg:"dsize less than or equal value"; dsize:<=10; sid:3; rev:1;)
.. container:: example-rule
alert tcp any any -> any any (msg:"dsize greater than value"; dsize:>8; sid:4; rev:1;)
.. container:: example-rule
alert tcp any any -> any any (msg:"dsize greater than or equal value"; dsize:>=10; sid:5; rev:1;)
.. container:: example-rule
alert tcp any any -> any any (msg:"dsize range value"; dsize:8<>20; sid:6; rev:1;)
.. container:: example-rule
alert tcp any any -> any any (msg:"dsize not equal value"; dsize:!9; sid:7; rev:1;)
.. _byte_test:

2
doc/userguide/rules/pgsql-keywords.rst
Unescape Escape View File

@ -30,4 +30,4 @@ Examples
.. container:: example-rule
alert pgsql any any -> any any (msg:"Simple delete rule";
:example-rule-emphasis:`pgsql.query; content:"delete"; nocase` sid:2;)
:example-rule-emphasis:`pgsql.query; content:"delete"; nocase;` sid:2;)

3
doc/userguide/rules/smb-keywords.rst
Unescape Escape View File

@ -76,6 +76,9 @@ Signature Example:
alert smb $HOME_NET any -> any any (msg:"SMBv1 version rule"; \
:example-rule-options:`smb.version:1;` sid:1;)
.. container:: example-rule
alert smb $HOME_NET any -> any any (msg:"SMBv2 version rule"; \
:example-rule-options:`smb.version:2;` sid:2;)

Write Preview
Loading…
Cancel
Save