From 292b3eb9b32838a239e4b30c009e0a7df65c010d Mon Sep 17 00:00:00 2001 From: jason taylor Date: Tue, 2 Jan 2024 21:04:03 +0000 Subject: [PATCH] doc: update http.request_line keyword information Ticket: 3025 Signed-off-by: jason taylor --- doc/userguide/rules/http-keywords.rst | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/doc/userguide/rules/http-keywords.rst b/doc/userguide/rules/http-keywords.rst index 67821dc967..118137445f 100644 --- a/doc/userguide/rules/http-keywords.rst +++ b/doc/userguide/rules/http-keywords.rst @@ -280,11 +280,23 @@ Example HTTP Request:: http.request_line ----------------- -The ``http.request_line`` forces the whole HTTP request line to be inspected. +The ``http.request_line`` keyword is used to match on the entire contents of +the HTTP request line. -Example:: +Example HTTP Request:: + + GET /index.html HTTP/1.1 + User-Agent: Mozilla/5.0 + Host: suricata.io + +.. container:: example-rule + + alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP Request Example"; \ + flow:established,to_server; :example-rule-options:`http.request_line; \ + content:"GET /index.html HTTP/1.1";` bsize:24; classtype:bad-unknown; \ + sid:60; rev:1;) - alert http any any -> any any (http.request_line; content:"GET / HTTP/1.0"; sid:1;) +.. note:: ``http.request_line`` does not include the trailing \\r\\n .. _http.header: