doc: update ftp keyword doc example rule format

Signed-off-by: jason taylor <jtfas90@gmail.com>
pull/9985/head
jason taylor 2 years ago committed by Victor Julien
parent bb1f7575d3
commit e4077b8803

@ -1,6 +1,8 @@
FTP/FTP-DATA Keywords
=====================
.. role:: example-rule-options
ftpdata_command
---------------
@ -12,14 +14,13 @@ Syntax::
ftpdata_command:(retr|stor)
Examples::
ftpdata_command:retr
ftpdata_command:stor
Signature Example:
Signature example::
.. container:: example-rule
alert ftp-data any any -> any any (msg:"FTP store password"; filestore; filename:"password"; ftpdata_command:stor; sid:3; rev:1;)
alert ftp-data any any -> any any (msg:"FTP store password"; \
filestore; filename:"password"; \
:example-rule-options:`ftpdata_command:stor;` sid:3; rev:1;)
ftpbounce
---------
@ -35,9 +36,12 @@ file.name
The ``file.name`` keyword can be used at the FTP application level.
Example::
Signature Example:
.. container:: example-rule
alert ftp-data any any -> any any (msg:"ftp layer file.name keyword usage"; \
file.name; content:"file.txt"; classtype:bad-unknown; sid:1; rev:1;)
alert ftp-data any any -> any any (msg:"FTP file.name usage"; \
:example-rule-options:`file.name; content:"file.txt";` \
classtype:bad-unknown; sid:1; rev:1;)
For additional information on the ``file.name`` keyword, see :doc:`file-keywords`.
Loading…
Cancel
Save