doc: document dataset-lookup

Ticket: #5184
5 years ago · a1a22cccd2
parent 537fd76787
commit a1a22cccd2
1 changed files with 20 additions and 0 deletions
--- a/doc/userguide/rules/datasets.rst
+++ b/doc/userguide/rules/datasets.rst
@ -184,6 +184,26 @@ set name
 type
  Data type: string, md5, sha256

+dataset-lookup
+~~~~~~~~~~~~~~
+
+Unix Socket command to test if data is in a set. 
+
+Syntax::
+
+    dataset-lookup <set name> <set type> <data>
+
+set name
+  Name of an already defined dataset
+type
+  Data type: string, md5, sha256
+data
+  Data to test in serialized form (base64 for string, hex notation for md5/sha256)
+
+Example testing if 'google.com' is in the set 'myset'::
+
+    dataset-lookup myset string Z29vZ2xlLmNvbQ==
+
 dataset-dump
 ~~~~~~~~~~~~