doc: update rev and gid userguide meta wording

Signed-off-by: jason taylor <jtfas90@gmail.com>
pull/7654/head
jason taylor 4 years ago committed by Victor Julien
parent b9cb66c58f
commit 39bc56ec97

@ -69,18 +69,15 @@ Example of rev in a signature:
.. tip:: .. tip::
It is a convention that sid comes before rev, and both are the last It is a standard practice in rule writing that the sid keyword is expressed before the rev keyword. The sid and rev keywords are commonly put as the last two keywords in a signature.
of all keywords.
gid (group ID) gid (group ID)
-------------- --------------
The gid keyword can be used to give different groups of signatures The gid keyword can be used to give different groups of signatures
another id value (like in sid). Suricata uses by default gid 1. It is another id value (like in sid). Suricata uses by default gid 1. It is
possible to modify this. It is not usual that it will be changed, and possible to modify this. In most cases it will be unnecessary to change the default gid value. Changing the gid value usually has no technical implications, the value is only noticed in the alert.
changing it has no technical implications. You can only notice it in
the alert.
Example of gid in an alert of fast.log. In the part [1:2008124:2], 1 is the gid (2008124 is the sid and 2 the rev). Example of gid in an alert entry in the fast.log file. In the part [1:123], 1 is the gid (123 is the sid and 1 is the rev).
.. container:: example-rule .. container:: example-rule

Loading…
Cancel
Save