From d7999563486c82f60a101ccb5857c70aa932522e Mon Sep 17 00:00:00 2001 From: jason taylor Date: Mon, 2 May 2022 12:06:56 +0000 Subject: [PATCH] doc: add note about file.data and file_data Signed-off-by: jason taylor --- doc/userguide/rules/http-keywords.rst | 3 +++ 1 file changed, 3 insertions(+) diff --git a/doc/userguide/rules/http-keywords.rst b/doc/userguide/rules/http-keywords.rst index 8436a41a76..69db08c8f1 100644 --- a/doc/userguide/rules/http-keywords.rst +++ b/doc/userguide/rules/http-keywords.rst @@ -772,6 +772,9 @@ Flash decompression must be enabled under ``libhtp`` configuration: Notes ~~~~~ +- file.data is the preferred notation, however, file_data is still + recognized by the engine and works as well. + - If a HTTP body is using gzip or deflate, ``file.data`` will match on the decompressed data.