From 83a8df90f3723f8625dfe1d2cdd35cebc4caf832 Mon Sep 17 00:00:00 2001
From: Eric Leblond <eric@regit.org>
Date: Sun, 24 Feb 2019 09:30:38 +0100
Subject: [PATCH] doc: improvement of xbits documentation page

---
 doc/userguide/rules/xbits.rst | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/doc/userguide/rules/xbits.rst b/doc/userguide/rules/xbits.rst
index 41049df1d1..ca48874f9f 100644
--- a/doc/userguide/rules/xbits.rst
+++ b/doc/userguide/rules/xbits.rst
@@ -5,7 +5,7 @@ Set, unset, toggle and check for bits stored per host or ip_pair.
 
 Syntax::
 
-    xbits:<set|unset|isset|toggle>,<name>,track <ip_src|ip_dst|ip_pair>;
+    xbits:<set|unset|isset|isnotset|toggle>,<name>,track <ip_src|ip_dst|ip_pair>;
     xbits:<set|unset|isset|toggle>,<name>,track <ip_src|ip_dst|ip_pair> \
         [,expire <seconds>];
     xbits:<set|unset|isset|toggle>,<name>,track <ip_src|ip_dst|ip_pair> \
@@ -23,6 +23,8 @@ Notes
 
 -  To not alert, use ``noalert;``
 
+- the ``toggle`` option will flip the value of the xbits.
+
 -  See also:
 
    -  `https://blog.inliniac.net/2014/12/21/crossing-the-streams-in-suricata/ <https://blog.inliniac.net/2014/12/21/crossing-the-streams-in-suricata/>`_