diff --git a/doc/userguide/rules/ftp-keywords.rst b/doc/userguide/rules/ftp-keywords.rst index 068b14e33c..0d25f60312 100644 --- a/doc/userguide/rules/ftp-keywords.rst +++ b/doc/userguide/rules/ftp-keywords.rst @@ -29,3 +29,15 @@ Detect FTP bounce attacks. Syntax:: ftpbounce + +file.name +--------- + +The ``file.name`` keyword can be used at the FTP application level. + +Example:: + +alert ftp-data any any -> any any (msg:"ftp layer file.name keyword usage"; \ +file.name; content:"file.txt"; classtype:bad-unknown; sid:1; rev:1;) + +For additional information on the ``file.name`` keyword, see :doc:`file-keywords`. \ No newline at end of file