doc: add usage of flowbits OR op

Ticket 5130
3 years ago · 015c9fe1e3
parent 6c616d84b1
commit 015c9fe1e3
1 changed files with 7 additions and 0 deletions
--- a/doc/userguide/rules/flow-keywords.rst
+++ b/doc/userguide/rules/flow-keywords.rst
@ -53,6 +53,13 @@ will be generated.
 It is possible to use flowbits several times in a rule and combine the
 different functions.

+It is also possible to perform an `OR` operation with flowbits with `|` op.
+
+Example::
+  alert http any any -> any any (msg: "User1 or User2 logged in"; content:"login"; flowbits:isset,user1|user2; sid:1;)
+
+This can be used with either `isset` or `isnotset` action.
+
 flow
 ----