From c95850c6ce334af9174ef6efeeb19347e2804b1b Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Thu, 24 Sep 2020 11:33:07 +0200
Subject: [PATCH] doc/rules: document config rule option

---
 doc/userguide/rules/config.rst | 44 ++++++++++++++++++++++++++++++++++
 doc/userguide/rules/index.rst  |  1 +
 2 files changed, 45 insertions(+)
 create mode 100644 doc/userguide/rules/config.rst

diff --git a/doc/userguide/rules/config.rst b/doc/userguide/rules/config.rst
new file mode 100644
index 0000000000..260364378a
--- /dev/null
+++ b/doc/userguide/rules/config.rst
@@ -0,0 +1,44 @@
+Config Rules
+============
+
+Config rules are rules that when matching, will change the configuration of
+Suricata for a flow, transaction, packet or other unit.
+
+Example::
+
+  config dns any any -> any any (dns.query; content:"suricata"; config: logging disable, type tx, scope tx; sid:1;)
+
+This example will detect if a DNS query contains the string `suricata` and if
+so disable the DNS transaction logging. This means that `eve.json` records,
+but also Lua output, will not be generated/triggered for this DNS transaction.
+
+Keyword
+-------
+
+The `config` rule keyword provides the setting and the scope of the change.
+
+Syntax::
+
+  config:<subsys> <action>, type <type>, scope <scope>;
+
+`subsys` can be set to:
+
+* `logging` setting affects logging.
+
+`type` can be set to:
+
+* `tx` sub type of the `subsys`. If `subsys` is set to `logging`, setting the `type` to `tx` means transaction logging is affected.
+
+`scope` can be set to:
+
+* `tx` setting affects the matching transaction.
+
+The `action` in `<subsys>` is currently limited to `disable`.
+
+
+Action
+------
+
+Config rules can, but don't have to, use the `config` rule action. The `config`
+rule action won't generate an alert when the rule matches, but the rule actions
+will still be applied. It is equivalent to `alert ... (noalert; ...)`.
diff --git a/doc/userguide/rules/index.rst b/doc/userguide/rules/index.rst
index 5e9dca8ebe..651763a64a 100644
--- a/doc/userguide/rules/index.rst
+++ b/doc/userguide/rules/index.rst
@@ -32,6 +32,7 @@ Suricata Rules
    xbits
    thresholding
    ip-reputation-rules
+   config
    datasets
    rule-lua-scripting
    differences-from-snort