doc: update tls_cert_notafter/before

refs #3065 * add explanation on omitted values
5 months ago · c98112eb67
parent 940f691245
commit c98112eb67
1 changed files with 6 additions and 0 deletions
--- a/doc/userguide/rules/tls-keywords.rst
+++ b/doc/userguide/rules/tls-keywords.rst
@ -158,6 +158,12 @@ Example::
  alert tls any any -> any any (msg:"match cert NotAfter"; \
    tls_cert_notafter:>2015; sid:200006;)

+For omitted formats, the first date is assumed.
+
+``YYYY-MM`` => ``YYYY-MM-01``.
+
+``YYYY`` => ``YYYY-01-01``.
+
 tls_cert_expired
 ----------------