suricata

main-8.0.x

main

main-7.0.x

master-6.0.x

master-5.0.x

master-4.1.x

master-4.0.x

master-3.2.x

suricata-8.0.6

suricata-7.0.17

suricata-8.0.5

suricata-7.0.16

suricata-8.0.4

suricata-7.0.15

suricata-8.0.3

suricata-7.0.14

suricata-8.0.2

suricata-7.0.13

suricata-8.0.1

suricata-7.0.12

suricata-8.0.0

suricata-7.0.11

suricata-8.0.0-rc1

suricata-8.0.0-beta1

suricata-7.0.10

suricata-7.0.9

suricata-7.0.8

suricata-7.0.7

suricata-7.0.6

suricata-6.0.20

suricata-7.0.5

suricata-6.0.19

suricata-6.0.18

suricata-7.0.4

suricata-6.0.17

suricata-7.0.3

suricata-6.0.16

suricata-7.0.2

suricata-6.0.15

suricata-7.0.1

suricata-6.0.14

suricata-7.0.0

suricata-7.0.0-rc2

suricata-6.0.13

suricata-6.0.12

suricata-6.0.11

suricata-7.0.0-rc1

suricata-6.0.10

suricata-6.0.9

suricata-7.0.0-beta1

suricata-6.0.8

suricata-6.0.7

suricata-6.0.6

suricata-5.0.10

suricata-6.0.5

suricata-5.0.9

suricata-6.0.4

suricata-5.0.8

suricata-6.0.3

suricata-5.0.7

suricata-6.0.2

suricata-5.0.6

suricata-6.0.1

suricata-5.0.5

suricata-4.1.10

suricata-4.1.9

suricata-5.0.4

suricata-6.0.0

suricata-6.0.0-rc1

suricata-6.0.0-beta1

suricata-5.0.3

suricata-4.1.8

suricata-4.1.7

suricata-5.0.2

suricata-4.1.6

suricata-5.0.1

suricata-5.0.0

suricata-5.0.0-rc1

suricata-4.1.5

suricata-5.0.0-beta1

suricata-4.1.4

suricata-4.1.3

suricata-4.0.7

suricata-4.1.2

suricata-4.1.1

suricata-4.1.0

suricata-4.0.6

suricata-4.1.0-rc2

suricata-4.1.0-rc1

suricata-4.0.5

suricata-4.1.0-beta1

suricata-4.0.4

suricata-4.0.3

suricata-4.0.2

suricata-3.2.5

suricata-4.0.1

suricata-3.2.4

suricata-4.0.0

suricata-4.0.0-rc2

suricata-3.2.3

suricata-4.0.0-rc1

suricata-4.0.0-beta1

suricata-3.2.2

suricata-3.1.4

suricata-3.2.1

suricata-3.2

suricata-3.2RC1

suricata-3.1.3

suricata-3.2beta1

suricata-3.1.2

suricata-3.1.1

suricata-3.1

suricata-3.0.2

suricata-3.1RC1

suricata-3.0.1

suricata-3.0.1RC1

suricata-3.0

suricata-2.0.11

suricata-3.0RC3

suricata-3.0RC2

suricata-3.0RC1

suricata-2.0.10

suricata-2.0.9

suricata-2.1beta4

suricata-2.0.8

suricata-2.0.7

suricata-2.1beta3

suricata-2.0.6

suricata-2.0.5

suricata-2.1beta2

suricata-2.0.4

suricata-2.1beta1

suricata-2.0.3

suricata-2.0.2

suricata-2.0.1

suricata-2.0.1rc1

suricata-2.0

suricata-2.0rc3

suricata-2.0rc2

suricata-2.0rc1

suricata-2.0beta2

suricata-1.4.7

suricata-1.4.6

suricata-1.4.5

suricata-2.0beta1

suricata-1.4.4

suricata-1.4.3

suricata-1.4.2

suricata-1.4.1

suricata-1.3.6

suricata-1.4

suricata-1.3.5

suricata-1.4rc1

suricata-1.3.4

suricata-1.4beta3

suricata-1.3.3

suricata-1.4beta2

suricata-1.3.2

suricata-1.4beta1

suricata-1.3.1

suricata-1.3

suricata-1.3rc1

suricata-1.3beta2

suricata-1.3beta1

suricata-1.2.1

suricata-1.2

suricata-1.2rc1

suricata-1.2beta1

suricata-1.1.1

suricata-0.8.2

suricata-1.0.0

suricata-1.0.1

suricata-1.0.2

suricata-1.0.3

suricata-1.0.4

suricata-1.0.5

suricata-1.1

suricata-1.1beta1

suricata-1.1beta2

suricata-1.1beta3

suricata-1.1rc1

Commit Graph

Author	SHA1	Message	Date
Jeff Lucovsky	d2e3bf1d34	doc: document xor transform variable key and offset syntax Add user-facing documentation for the xor transform's 'extract <nbytes> <offset>' syntax and offset parameter in rules/transforms.rst. Add a devguide section (devguide/extending/detect/transforms.rst) covering the detection pipeline execution order, how transforms run before detection-time keywords, and how xor reads key bytes directly from the raw buffer at a specified position and width. Explains how the engine deduplicates inspection buffers for rules with variable keys at different buffer positions. Issue: 8671	2 months ago

Author

SHA1

Message

Date

Jeff Lucovsky

d2e3bf1d34

doc: document xor transform variable key and offset syntax

Add user-facing documentation for the xor transform's 'extract <nbytes>
<offset>' syntax and offset parameter in rules/transforms.rst.

Add a devguide section (devguide/extending/detect/transforms.rst)
covering the detection pipeline execution order, how transforms run
before detection-time keywords, and how xor reads key bytes directly
from the raw buffer at a specified position and width. Explains how
the engine deduplicates inspection buffers for rules with variable
keys at different buffer positions.

Issue: 8671

1 Commits (d2e3bf1d34fa10ca0658db768f61e2045955f55f)