doc/rules/internals: minor fixes

Fix typo and add a reference about the classtype keyword effect.

Related to
Task #5449
pull/13880/head
Juliana Fajardini 2 months ago committed by Victor Julien
parent e79d735374
commit 21b27597d6

@ -110,6 +110,7 @@ In the part [1:123], the first 1 is the gid (123 is the sid and 1 is the rev).
07/12/2022-21:59:26.713297 [**] [:example-rule-emphasis:`1`:123:1] HTTP GET Request Containing Rule in URI [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 192.168.225.121:12407 -> 172.16.105.84:80 07/12/2022-21:59:26.713297 [**] [:example-rule-emphasis:`1`:123:1] HTTP GET Request Containing Rule in URI [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 192.168.225.121:12407 -> 172.16.105.84:80
.. _classtype:
classtype classtype
--------- ---------

@ -72,6 +72,9 @@ had flowbits set and a rule action with higher priority, for instance.
extra logic for prioritization. For example, considering flowbits, the extra logic for prioritization. For example, considering flowbits, the
priority is write (highest) > write + read > read (lowest) > no flowbits. priority is write (highest) > write + read > read (lowest) > no flowbits.
.. note:: it is also possible to have a rule priority set implicitly, through
the `classtype` keyword. Check :ref:`classtype`.
Another important element when considering rule parsing, processing and matching Another important element when considering rule parsing, processing and matching
is that the ruleset is optimized into signature group heads based on the signature is that the ruleset is optimized into signature group heads based on the signature
elements (thus, for instance, a TCP rule and an UDP rule would be loaded into elements (thus, for instance, a TCP rule and an UDP rule would be loaded into
@ -179,7 +182,7 @@ flow isn't flagged with ``pass``, it will be dropped with the third rule.
.. Tip:: .. Tip::
A more straightforward way to achieve that in Suricata 8 is using the firewall A more straightforward way to achieve that in Suricata 8 is using the firewall
more. See :doc:`../firewall/firewall-design`. mode. See :doc:`../firewall/firewall-design`.
Alerts not seen Alerts not seen
~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~

Loading…
Cancel
Save