suricata

You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

History

Jeff Lucovsky d2e3bf1d34 doc: document xor transform variable key and offset syntax Add user-facing documentation for the xor transform's 'extract <nbytes> <offset>' syntax and offset parameter in rules/transforms.rst. Add a devguide section (devguide/extending/detect/transforms.rst) covering the detection pipeline execution order, how transforms run before detection-time keywords, and how xor reads key bytes directly from the raw buffer at a specified position and width. Explains how the engine deduplicates inspection buffers for rules with variable keys at different buffer positions. Issue: 8671	3 weeks ago
..
index.rst	…
transforms.rst	…

Jeff Lucovsky d2e3bf1d34 doc: document xor transform variable key and offset syntax

Add user-facing documentation for the xor transform's 'extract <nbytes>
<offset>' syntax and offset parameter in rules/transforms.rst.

Add a devguide section (devguide/extending/detect/transforms.rst)
covering the detection pipeline execution order, how transforms run
before detection-time keywords, and how xor reads key bytes directly
from the raw buffer at a specified position and width. Explains how
the engine deduplicates inspection buffers for rules with variable
keys at different buffer positions.

Issue: 8671

index.rst

…

transforms.rst

…