Ralph Broenink
11990c7117
doc: Move the definition of modifier keywords to the introduction
7 years ago
Ralph Broenink
dfae19247d
doc: Completely rewrite the rules introduction for more clearity
7 years ago
Ralph Broenink
274c36eb2f
doc: Meta-settings -> Meta Keywords plus some textual changes
...
Most importantly, conventions are now placed in tip boxes
7 years ago
Ralph Broenink
3413793768
doc: Use lowercased keyword names as section titles
7 years ago
Ralph Broenink
a52aacb4ea
doc: Replace images of tables and rules with text in rules docs
...
In some chapters of the rules documentation, many sections used examples of rules, but these were inserted into images. These have been replaced by text and HTML emphasis.
Additionally, some tables embedded into images were also replaced by reST tables.
7 years ago
Mats Klepsland
9556d4fef3
doc: add documentation for tls_cert_fingerprint keyword
7 years ago
Victor Julien
1180687574
doc/file_data: add note on negated matching
...
Explain issue #2216 and how to avoid it.
7 years ago
Abbed
320b032a88
doc: small typo under '4.3.1.5' section
7 years ago
Eric Leblond
f5ad6a2095
doc: document target keyword
7 years ago
Andreas Herz
bf1a8d08da
doc: rephrase nocase placement explanation
7 years ago
Victor Julien
4697330b73
doc: flowints formatting cleanup
8 years ago
Victor Julien
0af562d4c8
doc: move parts out of snort difference doc
...
Move generic keyword descriptions to the keyword documentation.
8 years ago
David Wharton
a8d0ae460c
doc: removing (replaced) snort-compatibility.rst
...
snort-compatibility.rst replaced by differences-from-snort.rst
8 years ago
David Wharton
8a53d49e81
doc: replacing snort-compatibility link
...
The snort-compatibility.rst document is being replaced by
differences-from-snort.rst. This commit updates the link.
8 years ago
David Wharton
6bc7c64794
doc: overhaul of the snort-compatibility document
...
This is intended to replace the existing 'snort-compatibility.rst'
document.
Based on "The Suricata Rule Writing Guide for The Snort Expert"
2016 SuriCon talk.
8 years ago
Victor Julien
245a89b7e7
doc: http keywords update
8 years ago
Mats Klepsland
ee9f822b8e
doc: add documentation for tls_cert_serial keyword
8 years ago
David Wharton
1bf7ded224
doc: specify buffers that can be used for fast_pattern
...
Updated notes on the following buffers indicating that they can
be used for fast_pattern:
tls_cert_subject
tls_cert_issuer
tls_sni
8 years ago
David Wharton
b1ad770b36
doc: removed references to older Suricata versions
...
docs are versioned; references to older Suricata versions undesired.
8 years ago
Victor Julien
c477c4370e
doc: update for unix socket hostbits
8 years ago
Eric Leblond
c357dafed9
doc: document the tls_sni keyword
8 years ago
Victor Julien
bc38cd5932
doc: initial xbits documentation
8 years ago
Victor Julien
41074a87a0
doc: DNP3 support is now available
8 years ago
Jason Ish
0c6c9784a2
doc: document that that ;, \, " need to be escaped in rules
8 years ago
Jason Ish
1a724ba851
doc: flow: update and add new keywords
8 years ago
Victor Julien
56ffba9fd8
doc: initial app-layer keywords
...
Document app-layer-protocol and make a start with app-layer-event.
8 years ago
Victor Julien
e3b2d95100
doc: add recent tls keywords
8 years ago
Victor Julien
08b875c03b
doc: clean up fast_pattern
8 years ago
Victor Julien
f1046db113
doc: fix header keywords layout
8 years ago
Victor Julien
d80914d350
doc: move rule reload and adding rules into rule-management
8 years ago
Victor Julien
e24c3937b3
doc: add rule-management chapter
8 years ago
Victor Julien
e5ee665f24
doc: rewrite rule reload doc
8 years ago
Victor Julien
a35bea28f3
doc: rules-meta typo
8 years ago
Victor Julien
76b55214f0
doc: rules-meta small cleanup
8 years ago
Victor Julien
3cf1b12061
doc: http sticky vs modifier
8 years ago
Victor Julien
0d15593258
doc: move urilen to other uri keywords
8 years ago
Victor Julien
34bfacdee0
doc: add minimal http request/response line sections
8 years ago
Jason Ish
cd4c9e73f8
doc: fix sphinx warnings
...
This involved removing documents that were intentionally
not referenced as they are not good candidates for the
user guide.
8 years ago
Victor Julien
92b393ee9a
doc: include enip page
8 years ago
Victor Julien
a2d8cfb5d3
doc: reorder rule docs
8 years ago
kwong
a3ffebd835
Adding SCADA EtherNet/IP and CIP protocol support
...
Add support for the ENIP/CIP Industrial protocol
This is an app layer implementation which uses the "enip" protocol
and "cip_service" and "enip_command" keywords
Implements AFL entry points
8 years ago
Victor Julien
5bd906ae9f
doc: prefilter keyword and config
8 years ago
Victor Julien
73b355e24a
doc: fix lua keyword name
8 years ago
Victor Julien
7ad667f282
doc: move snort compat to rule chapter
8 years ago
Jason Ish
7f5ffeebad
doc: dns: sync up with wiki
8 years ago
Andreas Herz
7806ae8f57
docs: sync up to recent redmine
8 years ago
Jason Ish
a96225527a
doc: update url to modbus paper as advised by David Diallo.
8 years ago
Jason Ish
2751baae46
doc: rename from "sphinx" to "userguide"
8 years ago