doc: update http.response_body keyword information

Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>

doc/userguide/rules/http-keywords.rst

@@ -906,38 +906,36 @@ Example HTTP Response::
 http.response_body
 ------------------
 
-With the ``http.response_body`` sticky buffer, it is possible to
+The ``http.response_body`` keyword is used to match on the HTTP response body.
-match specifically and only on the HTTP response body. The keyword can
-be used in combination with all previously mentioned content modifiers
-like ``distance``, ``offset``, ``nocase``, ``within``, etc.
 
-Note: how much of the response/server body is inspected is controlled
+It is possible to use any of the :doc:`payload-keywords` with the
-in your :ref:`libhtp configuration section
+``http.response_body`` keyword.
-<suricata-yaml-configure-libhtp>` via the ``response-body-limit``
-setting.
 
-Notes
+Example HTTP Response::
-~~~~~
 
--  Using ``http.response_body`` is similar to having content matches
+  HTTP/1.1 200 OK
-   that come after ``file.data`` except that it doesn't permanently
+  Content-Type: text/html
-   (unless reset) set the detection pointer to the beginning of the
+  Server: nginx/0.8.54
-   server response body. i.e. it is not a sticky buffer.
 
--  ``http.response_body`` will match on gzip decoded data just like
+  Server response body
-   ``file.data`` does.
+
+.. container:: example-rule
 
--  Since ``http.response_body`` matches on a server response, it
+  alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"HTTP Response Body \
-   can't be used with the ``to_server`` or ``from_client`` flow
+  Example"; flow:established,to_client; :example-rule-options:`http.response_body; \
-   directives.
+  content:"Server response body";` classtype:bad-unknown; sid:120; rev:1;)
 
--  Corresponding PCRE modifier: ``Q``
+.. note:: ``http.response_body`` will match on gzip decoded data just like
+  :ref:`file.data` does.
 
--  further notes at the ``file.data`` section below.
+.. note:: How much of the response/server body is inspected is controlled
+  in your :ref:`libhtp configuration section
+  <suricata-yaml-configure-libhtp>` via the ``response-body-limit``
+  setting.
 
-``http.response_body`` replaces the previous keyword name: ```http_server_body``. You may continue
+.. note:: ``http.response_body`` replaces the previous keyword name,
-+to use the previous name, but it's recommended that rules be converted to use
+  ``http_server_body``. ``http_server_body`` can still be used but it is
-+the new name.
+  recommended that rules be converted to use ``http.response_body``.
 
 .. _http.server: