From 95237f98944d9285278549c207ad2a8ae8f6a682 Mon Sep 17 00:00:00 2001 From: jason taylor Date: Wed, 16 Oct 2019 21:16:52 -0400 Subject: [PATCH] docs: update datasets examples Signed-off-by: jason taylor --- doc/userguide/rules/datasets.rst | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/doc/userguide/rules/datasets.rst b/doc/userguide/rules/datasets.rst index 4a2b174c59..1e01de9340 100644 --- a/doc/userguide/rules/datasets.rst +++ b/doc/userguide/rules/datasets.rst @@ -32,11 +32,15 @@ Example of sets for tracking unique values:: type: sha256 state: dns-sha256-seen.lst -Rules to go with the above:: +Rules to go with the above: - http.user_agent; dataset:set,ua-seen; - dns.query; to_sha256; dataset:set,dns-sha256-seen; +.. container:: example-rule + alert dns any any -> any any (msg:"dns list test"; dns.query; to_sha256; dataset:isset,dns-sha256-seen; sid:123; rev:1;) + +.. container:: example-rule + + alert http any any -> any any (msg: "http user-agent test"; http.user_agent; dataset:set,ua-seen; sid:234; rev:1;) Rule keywords ------------- @@ -72,7 +76,7 @@ Data Reputation allows matching data against a reputation list. Syntax:: datarep:,,, \ - [, type , load ]; + [, load , type ]; Example rules could look like::