From 7020cffaa807ad203db6ca2abd8038d86ae62133 Mon Sep 17 00:00:00 2001 From: Mats Klepsland Date: Tue, 14 May 2019 07:42:16 +0200 Subject: [PATCH] userguide: 'sticky' instead of 'Sticky' for all tls keywords --- doc/userguide/rules/ja3-keywords.rst | 4 ++-- doc/userguide/rules/tls-keywords.rst | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/doc/userguide/rules/ja3-keywords.rst b/doc/userguide/rules/ja3-keywords.rst index 904cfd9a7a..d5707261b5 100644 --- a/doc/userguide/rules/ja3-keywords.rst +++ b/doc/userguide/rules/ja3-keywords.rst @@ -16,7 +16,7 @@ Example:: ja3.hash; content:"e7eca2baf4458d095b7f45da28c16c34"; \ sid:100001;) -``ja3.hash`` is a 'Sticky buffer'. +``ja3.hash`` is a 'sticky buffer'. ``ja3.hash`` can be used as ``fast_pattern``. @@ -35,7 +35,7 @@ Example:: ja3.string; content:"19-20-21-22"; \ sid:100002;) -``ja3.string`` is a 'Sticky buffer'. +``ja3.string`` is a 'sticky buffer'. ``ja3.string`` can be used as ``fast_pattern``. diff --git a/doc/userguide/rules/tls-keywords.rst b/doc/userguide/rules/tls-keywords.rst index fa31fbe2d4..89cef92e9c 100644 --- a/doc/userguide/rules/tls-keywords.rst +++ b/doc/userguide/rules/tls-keywords.rst @@ -13,7 +13,7 @@ Examples:: tls.cert_subject; content:"CN=*.googleusercontent.com"; isdataat:!1,relative; tls.cert_subject; content:"google.com"; nocase; pcre:"/google.com$/"; -``tls.cert_subject`` is a 'Sticky buffer'. +``tls.cert_subject`` is a 'sticky buffer'. ``tls.cert_subject`` can be used as ``fast_pattern``. @@ -31,7 +31,7 @@ Examples:: tls.cert_issuer; content:"WoSign"; nocase; isdataat:!1,relative; tls.cert_issuer; content:"StartCom"; nocase; pcre:"/StartCom$/"; -``tls.cert_issuer`` is a 'Sticky buffer'. +``tls.cert_issuer`` is a 'sticky buffer'. ``tls.cert_issuer`` can be used as ``fast_pattern``. @@ -49,7 +49,7 @@ Example:: alert tls any any -> any any (msg:"match cert serial"; \ tls.cert_serial; content:"5C:19:B7:B1:32:3B:1C:A1"; sid:200012;) -``tls.cert_serial`` is a 'Sticky buffer'. +``tls.cert_serial`` is a 'sticky buffer'. ``tls.cert_serial`` can be used as ``fast_pattern``. @@ -69,7 +69,7 @@ Example:: content:"4a:a3:66:76:82:cb:6b:23:bb:c3:58:47:23:a4:63:a7:78:a4:a1:18"; \ sid:200023;) -``tls.cert_fingerprint`` is a 'Sticky buffer'. +``tls.cert_fingerprint`` is a 'sticky buffer'. ``tls.cert_fingerprint`` can be used as ``fast_pattern``. @@ -87,7 +87,7 @@ Examples:: tls.sni; content:"oisf.net"; nocase; isdataat:!1,relative; tls.sni; content:"oisf.net"; nocase; pcre:"/oisf.net$/"; -``tls.sni`` is a 'Sticky buffer'. +``tls.sni`` is a 'sticky buffer'. ``tls.sni`` can be used as ``fast_pattern``.