From 9d1ad0187e0cda5db6be413bbfb016c78a1e8d8d Mon Sep 17 00:00:00 2001 From: jason taylor Date: Wed, 20 Sep 2023 21:42:10 +0000 Subject: [PATCH] doc: add file.name information to nfs keyword doc Signed-off-by: jason taylor --- doc/userguide/rules/index.rst | 1 + doc/userguide/rules/nfs-keywords.rst | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+) create mode 100644 doc/userguide/rules/nfs-keywords.rst diff --git a/doc/userguide/rules/index.rst b/doc/userguide/rules/index.rst index 76266b3345..2715da79ac 100644 --- a/doc/userguide/rules/index.rst +++ b/doc/userguide/rules/index.rst @@ -33,6 +33,7 @@ Suricata Rules ike-keywords http2-keywords quic-keywords + nfs-keywords app-layer xbits thresholding diff --git a/doc/userguide/rules/nfs-keywords.rst b/doc/userguide/rules/nfs-keywords.rst new file mode 100644 index 0000000000..22c3304f63 --- /dev/null +++ b/doc/userguide/rules/nfs-keywords.rst @@ -0,0 +1,19 @@ +NFS Keywords +============ + +.. role:: example-rule-options + +file.name +--------- + +The ``file.name`` keyword can be used at the NFS application level. + +Signature Example: + +.. container:: example-rule + + alert nfs any any -> any any (msg:"NFS file.name usage"; \ + :example-rule-options:`file.name; content:"file.txt";` \ + classtype:bad-unknown; sid:1; rev:1;) + +For additional information on the ``file.name`` keyword, see :doc:`file-keywords`. \ No newline at end of file