doc: document the tls_sni keyword

8 years ago · c357dafed9
parent 1af713d67d
commit c357dafed9
1 changed files with 12 additions and 0 deletions
--- a/doc/userguide/rules/tls-keywords.rst
+++ b/doc/userguide/rules/tls-keywords.rst
@ -27,6 +27,18 @@ Examples::

 ``tls_cert_issuer`` is a 'Sticky buffer'.

+tls_sni
+-------
+
+Match TLS/SSL Server Name Indication field.
+
+Examples::
+
+  tls_sni; content:"oisf.net"; nocase; isdataat:!1,relative;
+  tls_sni; content:"oisf.net"; nocase; pcre:"/oisf.net$/";
+
+``tls_sni`` is a 'Sticky buffer'.
+
 tls_cert_notbefore
 ------------------