@ -293,7 +293,7 @@ It can take an argument "or_else" to match on absent buffer or on what comes nex
alert http any any -> any any (msg:"HTTP request without referer"; :example-rule-emphasis:`http.referer; absent: or_else;` content: !"abc"; sid:1; rev:1;)
For files (ie ``file.data``), absent means there are no files in the transaction.
For files (i.e ``file.data``), absent means there are no files in the transaction.
bsize
-----
@ -676,7 +676,7 @@ entropy
The ``entropy`` keyword calculates the Shannon entropy value for content and compares it with
an entropy value. When there is a match, rule processing will continue. Entropy values
are between 0.0 and 8.0, inclusive. Internally, entropy is representing as a 64-bit
are between 0.0 and 8.0, inclusive. Internally, entropy is represented as a 64-bit
floating point value.
The ``entropy`` keyword syntax is the keyword entropy followed by options
@ -760,7 +760,7 @@ Example of the rpc keyword in a rule:
replace
-------
The replace content modifier can only be used in ips. It adjusts
The replace content modifier can only be used in IPS. It adjusts
network traffic. It changes the content it follows ('abc') into