doc: improvement of xbits documentation page

6 years ago · 83a8df90f3
parent 43ede4db7f
commit 83a8df90f3
1 changed files with 3 additions and 1 deletions
--- a/doc/userguide/rules/xbits.rst
+++ b/doc/userguide/rules/xbits.rst
@ -5,7 +5,7 @@ Set, unset, toggle and check for bits stored per host or ip_pair.

 Syntax::

-    xbits:<set|unset|isset|toggle>,<name>,track <ip_src|ip_dst|ip_pair>;
+    xbits:<set|unset|isset|isnotset|toggle>,<name>,track <ip_src|ip_dst|ip_pair>;
    xbits:<set|unset|isset|toggle>,<name>,track <ip_src|ip_dst|ip_pair> \
        [,expire <seconds>];
    xbits:<set|unset|isset|toggle>,<name>,track <ip_src|ip_dst|ip_pair> \
@ -23,6 +23,8 @@ Notes

 -  To not alert, use ``noalert;``

+- the ``toggle`` option will flip the value of the xbits.
+
 -  See also:

   -  `https://blog.inliniac.net/2014/12/21/crossing-the-streams-in-suricata/ <https://blog.inliniac.net/2014/12/21/crossing-the-streams-in-suricata/>`_