Commit Graph

10 Commits (6f339abdf01f972d213d1c9e76ff3d427e1eb183)

Author SHA1 Message Date
Victor Julien 07738af868 detect/content: introduce startswith modifier
Add startswith modifier to simplify matching patterns at the start
of a buffer.

Instead of:
    content:"abc"; depth:3;
This enables:
    content:"abc"; startswith;

Especially with longer patterns this makes the intention of the rule
more clear and eases writing the rules.

Internally it's simply a shorthand for 'depth:<pattern len>;'.

Ticket https://redmine.openinfosecfoundation.org/issues/742
7 years ago
Ralph Broenink 722cff1862 doc: Restructure ToC
* All sections up to 2 levels deep are now shown regardless of whether they are a separate page
* Rename Xbits and Thresholding for more consistent naming
* Minor adjustment in the Payload Keywords section
7 years ago
Ralph Broenink e9b25988ba doc: Move pcre entirely to Payload Keywords section
(plus remove lingering screenshot of a rule)
7 years ago
Ralph Broenink bb1bf2643d doc: Move fast_pattern and prefilter to dedicated page 7 years ago
Ralph Broenink fea037fda8 doc: Moved explanation of normalized buffers to rules introduction 7 years ago
Ralph Broenink 3413793768 doc: Use lowercased keyword names as section titles 7 years ago
Ralph Broenink a52aacb4ea doc: Replace images of tables and rules with text in rules docs
In some chapters of the rules documentation, many sections used examples of rules, but these were inserted into images. These have been replaced by text and HTML emphasis.

Additionally, some tables embedded into images were also replaced by reST tables.
7 years ago
Andreas Herz bf1a8d08da doc: rephrase nocase placement explanation 8 years ago
Jason Ish 0c6c9784a2 doc: document that that ;, \, " need to be escaped in rules 8 years ago
Jason Ish 2751baae46 doc: rename from "sphinx" to "userguide" 9 years ago