From 9e7d23d73f863f6235b25e945e699ffdf62af642 Mon Sep 17 00:00:00 2001 From: Alice Akaki Date: Mon, 24 Mar 2025 17:29:28 -0400 Subject: [PATCH] doc: add keywords to the multi-buffer-matching list --- doc/userguide/rules/multi-buffer-matching.rst | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/doc/userguide/rules/multi-buffer-matching.rst b/doc/userguide/rules/multi-buffer-matching.rst index c7ed0ea3d6..e9d4c0f8e1 100644 --- a/doc/userguide/rules/multi-buffer-matching.rst +++ b/doc/userguide/rules/multi-buffer-matching.rst @@ -74,6 +74,8 @@ not be met. Multiple buffer matching is currently enabled for use with the following keywords: +* ``dns.answer.name`` +* ``dns.query.name`` * ``dns.query`` * ``file.data`` * ``file.magic`` @@ -84,10 +86,20 @@ following keywords: * ``ike.vendor`` * ``krb5_cname`` * ``krb5_sname`` +* ``ldap.responses.dn`` +* ``ldap.responses.message`` * ``mqtt.subscribe.topic`` * ``mqtt.unsubscribe.topic`` * ``quic.cyu.hash`` * ``quic.cyu.string`` -* ``tls.certs`` +* ``sip.content_length`` +* ``sip.content_type`` +* ``sip.from`` +* ``sip.to`` +* ``sip.ua`` +* ``sip.via`` +* ``smtp.rcpt_to`` +* ``tls.alpn`` * ``tls.cert_subject`` +* ``tls.certs`` * ``tls.subjectaltname``