From faa815c674357415e85f72bf285d0d5624097c55 Mon Sep 17 00:00:00 2001
From: Juliana Fajardini <jufajardini@oisf.net>
Date: Tue, 25 Aug 2026 18:02:38 -0300
Subject: [PATCH] docs: add firewall-unsupported-keywords section

Related to
Ticket: 8551
Ticket: #8459
---
 .../firewall-unsupported-keywords.rst         | 28 +++++++++++++++++++
 doc/userguide/firewall/index.rst              |  1 +
 2 files changed, 29 insertions(+)
 create mode 100644 doc/userguide/firewall/firewall-unsupported-keywords.rst

diff --git a/doc/userguide/firewall/firewall-unsupported-keywords.rst b/doc/userguide/firewall/firewall-unsupported-keywords.rst
new file mode 100644
index 0000000000..0f26fc4235
--- /dev/null
+++ b/doc/userguide/firewall/firewall-unsupported-keywords.rst
@@ -0,0 +1,28 @@
+Firewall Mode Unsupported Keywords
+==================================
+
+Certain rule keywords are not supported in firewall mode, either completely or
+based on rulesets.
+
+A keyword may be unsupported in firewall rules, in threat detection rules, or in
+firewall mode altogether.
+
+This is done when there is a chance that the keyword would lead to the firewall
+verdict being skipped, contradicted, or when there could happen inconsistent
+states from interactions between firewall and threat detection rules matching.
+
+.. note:: Future releases may add support for such keywords where it makes sense.
+
+Unsupported Keywords
+--------------------
+
+Firewall Mode
+~~~~~~~~~~~~~
+
+* Bypass
+* Replace
+
+Threat Detection Rules
+~~~~~~~~~~~~~~~~~~~~~~
+
+* Config (both the ``config`` keyword and the ``config`` action)
diff --git a/doc/userguide/firewall/index.rst b/doc/userguide/firewall/index.rst
index 6b0d097c94..41ea6bea57 100644
--- a/doc/userguide/firewall/index.rst
+++ b/doc/userguide/firewall/index.rst
@@ -8,3 +8,4 @@ Firewall Mode
    firewall-stats
    tls-state-migration
    ssh-state-migration
+   firewall-unsupported-keywords