You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
suricata/doc/userguide/rules/transforms.rst

52 lines
1.4 KiB
ReStructuredText

Transformations
===============
Transformation keywords turn the data at a sticky buffer into something else.
Example::
alert http any any -> any any (file_data; strip_whitespace; \
content:"window.navigate("; sid:1;)
This example will match on traffic even if there are one or more spaces between
the ``navigate`` and ``(``.
The transforms can be chained. They are processed in the order in which they
appear in a rule. Each transforms output acts as input for the next one.
Example::
alert http any any -> any any (http_request_line; compress_whitespace; to_sha256; \
content:"|54A9 7A8A B09C 1B81 3725 2214 51D3 F997 F015 9DD7 049E E5AD CED3 945A FC79 7401|"; sid:1;)
.. note:: not all sticky buffers support transformations yet
strip_whitespace
----------------
Strips all whitespace as considered by the ``isspace()`` call in C.
Example::
alert http any any -> any any (file_data; strip_whitespace; \
content:"window.navigate("; sid:1;)
compress_whitespace
-------------------
Compresses all consecutive whitespace into a single space.
to_sha256
---------
Takes the buffer, calculates the SHA-256 hash and passes the raw hash value
on.
Example::
alert http any any -> any any (http_request_line; to_sha256; \
content:"|54A9 7A8A B09C 1B81 3725 2214 51D3 F997 F015 9DD7 049E E5AD CED3 945A FC79 7401|"; sid:1;)
.. note:: depends on libnss being compiled into Suricata