Juliana Fajardini
244a35d539
userguide: fix explanation about bsize ranges
...
Our code handles Uint ranges as exclusive, but for bsize, our
documentation stated that they're inclusive.
Cf. from uint.rs:
DetectUintMode::DetectUintModeRange => {
if val > x.arg1 && val < x.arg2 {
return true;
}
}
Task #6708
2 years ago
Philippe Antoine
b8bc2c7e0f
doc: integer keywords
...
Ticket: 6628
Document the generic detection capabilities for integer keywords.
and make every integer keyword pointing to this section.
2 years ago
Philippe Antoine
4933b817aa
doc: fix byte_test examples
...
As this keyword has 4 mandatory arguments, and some examples
had only three...
Ticket: 6629
2 years ago
Jeff Lucovsky
47e268d609
detect/byte_math: Document bytes variable name
...
Issue: 6145
Document that byte_math accepts a variable name for bytes (optional)
2 years ago
Jeff Lucovsky
3a4554fc2b
detect/byte-jump: Document var usage for nbytes
...
Issue: 6105
2 years ago
Jeff Lucovsky
73b943276e
doc/byte_test: Document byte_test variable usage
...
Issue: 6144
This commit updates the byte_test documentation now that a variable name
can be used for the nbytes value.
2 years ago
Victor Julien
c0d9b3c078
doc/userguide: spelling
2 years ago
Jeff Lucovsky
fd46c93a8f
doc/byte_math: Add divide by 0 discussion.
...
Issue: 5945
2 years ago
Jeff Lucovsky
35bbdf4124
doc/content: Add limits for distance/within
...
Ticket: 5740
2 years ago
Jeff Lucovsky
197ad51138
doc: Update bsize documentation
...
This commit updates the bsize documentation
1. Describe what happens when "content" immediately precedes "bsize"
2. Include the operators and
3. Include examples using the operators.
3 years ago
Jeff Lucovsky
192a31c74e
doc: Fixup byte* entries to display tables properly
3 years ago
jason taylor
c29942c029
userguide: update dsize documentation/examples
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
ca9e9009ba
doc: add bsize keyword examples
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
Philippe Antoine
fae7389ae2
pcre2: document the behavioral changes
4 years ago
Joshua Lumb
cf9b2b5fd1
detect-dsize: Add ! operator for dsize matching
4 years ago
Andreas Herz
a5f36eccf1
doc: add documentation for rawbytes keyword
4 years ago
Jeff Lucovsky
901fbae7b9
doc: Add byte_math documentation
5 years ago
Jeff Lucovsky
59cc3c6281
doc: Update byte_extract doc
5 years ago
Jeff Lucovsky
4ad6c5421a
doc: fix documentation typos
5 years ago
Jeff Lucovsky
bc01392e93
doc: Update byte_test documentation
5 years ago
jason taylor
1666bc0ad1
doc: minor capitalization fix
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
6 years ago
jason taylor
4f7dc4f136
doc: add bsize documentation and rule example
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
6 years ago
Travis Green
3f146cdd7e
doc: add endswith keyword docs
6 years ago
Andreas Herz
30fd80b0ef
doc: convert fancy quotes to straight quotes
6 years ago
Bryant Smith
398133b6ce
doc: add byte_* documentation to the userguide
...
Added byte_test, byte_jump and byte_extract description and example rules
6 years ago
Pascal Delalande
f2dca46382
doc: fix minor typo
7 years ago
Pascal Delalande
e3c5784dd5
doc: minor updates (tls custom, TODO removal, ftp/smb file rules)
7 years ago
Victor Julien
07738af868
detect/content: introduce startswith modifier
...
Add startswith modifier to simplify matching patterns at the start
of a buffer.
Instead of:
content:"abc"; depth:3;
This enables:
content:"abc"; startswith;
Especially with longer patterns this makes the intention of the rule
more clear and eases writing the rules.
Internally it's simply a shorthand for 'depth:<pattern len>;'.
Ticket https://redmine.openinfosecfoundation.org/issues/742
8 years ago
Ralph Broenink
722cff1862
doc: Restructure ToC
...
* All sections up to 2 levels deep are now shown regardless of whether they are a separate page
* Rename Xbits and Thresholding for more consistent naming
* Minor adjustment in the Payload Keywords section
8 years ago
Ralph Broenink
e9b25988ba
doc: Move pcre entirely to Payload Keywords section
...
(plus remove lingering screenshot of a rule)
8 years ago
Ralph Broenink
bb1bf2643d
doc: Move fast_pattern and prefilter to dedicated page
8 years ago
Ralph Broenink
fea037fda8
doc: Moved explanation of normalized buffers to rules introduction
8 years ago
Ralph Broenink
3413793768
doc: Use lowercased keyword names as section titles
8 years ago
Ralph Broenink
a52aacb4ea
doc: Replace images of tables and rules with text in rules docs
...
In some chapters of the rules documentation, many sections used examples of rules, but these were inserted into images. These have been replaced by text and HTML emphasis.
Additionally, some tables embedded into images were also replaced by reST tables.
8 years ago
Andreas Herz
bf1a8d08da
doc: rephrase nocase placement explanation
8 years ago
Jason Ish
0c6c9784a2
doc: document that that ;, \, " need to be escaped in rules
9 years ago
Jason Ish
2751baae46
doc: rename from "sphinx" to "userguide"
9 years ago