Commit Graph

22 Commits (e65643909acbabd4c8dd2027ba1f47328e4e3ee4)

Author SHA1 Message Date
Philippe Antoine e65643909a doc: move more examples to container:: example-rule
Ticket: 8372

And fix another bad rule
4 months ago
Shivani Bhardwaj 30bdaa44e1 doc: add elephant.flow usage section 8 months ago
Shivani Bhardwaj 06eafb79d6 detect/flow-pkts: check for both dir
The functionality of "both" can already be easily achieved by using both
"toclient" and "toserver" in a rule. This just adds the ease of
expression in rule. As it is added now, check the direction for the
pre-existing users of direction as well.
8 months ago
Juliana Fajardini d5810a42e1 userguide: document how suricata processes rules
Added a page that explains how rules are prioritized by Suri, as well
as what main different types of inspection happen and what elements are
involved when ordering rules.

Task #5449
11 months ago
Shivani Bhardwaj ad7ff1c91b flow/pkts: allow matching on either direction
For flow.bytes and flow.pkts keywords, allow matching in either
direction.

Feature 5646
2 years ago
Shivani Bhardwaj 52fd695e5a doc: update syntax for flow.pkts & flow.bytes 2 years ago
Juliana Fajardini 6e4a501e7c flowint: add isnotset support
Similar keywords use `isnotset`, while `flowint` only accepted `notset`
Opted to change the code, not only the regex, to keep the underlying
code also following the same patterns.

Task #7426
2 years ago
Juliana Fajardini 246acc7140 userguide: clarify flow:stateless explanation
While not incorrect, the previous wording made the sentence almost
paradoxical. While at it, also highlight a side effect that might not be
so clear to users.

Related to
Bug #6976
2 years ago
jason taylor aa919f8081 doc: update flowbits information
Ticket: #6991

Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Philippe Antoine b8bc2c7e0f doc: integer keywords
Ticket: 6628

Document the generic detection capabilities for integer keywords.
and make every integer keyword pointing to this section.
3 years ago
Philippe Antoine ab9b6e30b1 detect: adds flow integer keywords
Ticket: #6164

flow.pkts_toclient
flow.pkts_toserver
flow.bytes_toclient
flow.bytes_toserver
3 years ago
Philippe Antoine 390cf9248f detect: adds flow.age keyword
Ticket: #5536
4 years ago
Shivani Bhardwaj 015c9fe1e3 doc: add usage of flowbits OR op
Ticket 5130
5 years ago
Andreas Dolp b25350ee13 doc: Fix typo in documentation of rule keyword flow 5 years ago
Andreas Herz 30fd80b0ef doc: convert fancy quotes to straight quotes 7 years ago
Pascal Delalande f2dca46382 doc: fix minor typo 8 years ago
Victor Julien 5afeebf884 doc/flow: updates and cleanups to flow section 8 years ago
Ralph Broenink a55a6cdb62 doc: Move flowint as integral part of flow keywords 9 years ago
Ralph Broenink 3413793768 doc: Use lowercased keyword names as section titles 9 years ago
Jason Ish 1a724ba851 doc: flow: update and add new keywords 10 years ago
Andreas Herz 7806ae8f57 docs: sync up to recent redmine 10 years ago
Jason Ish 2751baae46 doc: rename from "sphinx" to "userguide" 10 years ago