diff --git a/doc/userguide/rules/http-keywords.rst b/doc/userguide/rules/http-keywords.rst index 8436a41a76..69db08c8f1 100644 --- a/doc/userguide/rules/http-keywords.rst +++ b/doc/userguide/rules/http-keywords.rst @@ -772,6 +772,9 @@ Flash decompression must be enabled under ``libhtp`` configuration: Notes ~~~~~ +- file.data is the preferred notation, however, file_data is still + recognized by the engine and works as well. + - If a HTTP body is using gzip or deflate, ``file.data`` will match on the decompressed data.