userguide/rules/meta: minor formatting adjustments

pull/7654/head
Jufajardini Reichow 3 years ago committed by Victor Julien
parent 45f14bb97c
commit 61f9f0df55

@ -8,6 +8,7 @@ they do have an effect on the way Suricata reports events/alerts.
msg (message)
-------------
The keyword msg gives contextual information about the signature and the possible alert.
The format of msg is::
@ -70,6 +71,7 @@ Example of sid in a signature:
rev (revision)
--------------
The sid keyword is commonly accompanied by the rev keyword. Rev
represents the version of the signature. If a signature is modified,
the number of rev will be incremented by the signature writers. The
@ -94,6 +96,7 @@ Example of rev in a signature:
gid (group ID)
--------------
The gid keyword can be used to give different groups of
signatures another id value (like in sid). Suricata by default uses gid 1.
It is possible to modify the default value. In most cases, it will be
@ -110,6 +113,7 @@ In the part [1:123], the first 1 is the gid (123 is the sid and 1 is the rev).
classtype
---------
The classtype keyword gives information about the classification of
rules and alerts. It consists of a short name, a long name and a
priority. It can tell for example whether a rule is just informational
@ -172,6 +176,7 @@ All the reference types are defined in the reference.config configuration file.
priority
--------
The priority keyword comes with a mandatory numeric value which can
range from 1 to 255. The values 1 through 4 are commonly used.
The highest priority is 1. Signatures with a higher priority will
@ -194,6 +199,7 @@ in eve alerts. The format is::
target
------
The target keyword allows the rules writer to specify which side of the
alert is the target of the attack. If specified, the alert event is enhanced
to contain information about source and target.

Loading…
Cancel
Save