mirror of https://github.com/OISF/suricata
detect-parse: parse sid in pre-scan
During the pre-scan for "requires", also parse the SID if possible. If
the rule fails high level parsing (syntax), the SID will not be
parsed.
But every keyword other than "sid" and "requires" should expect to be
provided with a parsed sid.
(cherry picked from commit 71bbba9248)
pull/10211/head
parent
e683e7604c
commit
1a7e88319a
Loading…
Reference in New Issue