You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
suricata/doc/userguide/rules
Victor Julien 07738af868 detect/content: introduce startswith modifier
Add startswith modifier to simplify matching patterns at the start
of a buffer.

Instead of:
    content:"abc"; depth:3;
This enables:
    content:"abc"; startswith;

Especially with longer patterns this makes the intention of the rule
more clear and eases writing the rules.

Internally it's simply a shorthand for 'depth:<pattern len>;'.

Ticket https://redmine.openinfosecfoundation.org/issues/742
9 years ago
..
dns-keywords
fast-pattern
flow-keywords
header-keywords
http-keywords
intro
normalized-buffers
payload-keywords
pcre doc: Move pcre entirely to Payload Keywords section 9 years ago
app-layer.rst
differences-from-snort.rst doc: Move IP reputation keyword to rules section 9 years ago
dnp3-keywords.rst
dns-keywords.rst
enip-keyword.rst
fast-pattern-explained.rst
file-keywords.rst keyword-filesize: add units 9 years ago
flow-keywords.rst doc: Move flowint as integral part of flow keywords 9 years ago
ftp-keywords.rst doc: update following ftp-data changes 9 years ago
header-keywords.rst doc: Make the header keywords section separate sections in ToC 9 years ago
http-keywords.rst doc: Minor changes in structuring of HTTP Keywords / Snort differences 9 years ago
index.rst doc: update following ftp-data changes 9 years ago
intro.rst doc: Amend the list of accepted protocols 9 years ago
ip-reputation-rules.rst doc: Move IP reputation keyword to rules section 9 years ago
meta.rst
modbus-keyword.rst
payload-keywords.rst detect/content: introduce startswith modifier 9 years ago
prefilter-keywords.rst
rule-lua-scripting.rst
thresholding.rst doc: Restructure ToC 9 years ago
tls-keywords.rst
xbits.rst doc: Restructure ToC 9 years ago