From 97a0ad342b372e62ae2fedc41f4187efd0c6520d Mon Sep 17 00:00:00 2001
From: Eric Leblond <el@stamus-networks.com>
Date: Wed, 25 Mar 2026 15:40:51 +0100
Subject: [PATCH] etc/schema: match on http response body

Matching on the HTTP response body is not really possible as it is
a transformed version that can not be accessed via the signature
language.
---
 etc/schema.json | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/etc/schema.json b/etc/schema.json
index b04154ff3c..c0aa42d784 100644
--- a/etc/schema.json
+++ b/etc/schema.json
@@ -2399,18 +2399,13 @@
                     "description": "Base64 of the response body",
                     "suricata": {
                         "keywords": [
-                            "file.data"
+                            "http.response_body", "file.data"
                         ]
                     }
                 },
                 "http_response_body_printable": {
                     "type": "string",
-                    "description": "The ascii-printable characters of the response body",
-                    "suricata": {
-                        "keywords": [
-                            "http.response_body", "file.data"
-                        ]
-                    }
+                    "description": "The ascii-printable characters of the response body"
                 },
                 "http_user_agent": {
                     "type": "string",