diff --git a/doc/userguide/rules/http-keywords.rst b/doc/userguide/rules/http-keywords.rst index 22823fd9f9..5d67de633b 100644 --- a/doc/userguide/rules/http-keywords.rst +++ b/doc/userguide/rules/http-keywords.rst @@ -829,15 +829,25 @@ Example HTTP Request:: http.stat_code -------------- -With the ``http.stat_code`` sticky buffer, it is possible to match -specifically and only on the HTTP status code buffer. The keyword can -be used in combination with all previously mentioned content modifiers -like ``distance``, ``offset``, ``nocase``, ``within``, etc. +The ``http.stat_code`` keyword is used to match on the HTTP status code +that can be present in an HTTP response. + +It is possible to use any of the :doc:`payload-keywords` with the +``http.stat_code`` keyword. + +Example HTTP Response:: -Example of ``http.stat_code`` in a HTTP response: + HTTP/1.1 200 OK + Content-Type: text/html + Server: nginx/0.8.54 + +.. container:: example-rule + alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"HTTP Stat Code Response \ + Example"; flow:established,to_client; :example-rule-options:`http.stat_code; \ + content:"200";` classtype:bad-unknown; sid:117; rev:1;) -Example of the purpose of ``http.stat_code``: +.. note:: ``http.stat_code`` does not include the leading or trailing space .. _http.stat_msg: