You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
suricata/doc/userguide/rules
Philippe Antoine 4ec90bd227 detect: absent keyword to test absence of sticky buffer
Ticket: 2224

It takes an argument to match only if the buffer is absent,
or it can still match if the buffer is present, but we test
the absence of some content.

For multi buffers, absent matches if there are 0 buffers.

For file keywords, absent matches if there is no file.
12 months ago
..
dataset-examples
dns-keywords
fast-pattern
flow-keywords
header-keywords
http-keywords
intro
normalized-buffers
payload-keywords
pcre
app-layer.rst
base64-keywords.rst doc/transform: Describe the from_base64 transform 1 year ago
bypass-keyword.rst
config.rst
datasets.rst detect/datasets: implement unset command 1 year ago
dcerpc-keywords.rst
dhcp-keywords.rst
differences-from-snort.rst lua: Remove luajit support 2 years ago
dnp3-keywords.rst
dns-keywords.rst
enip-keyword.rst enip: convert to rust 1 year ago
fast-pattern-explained.rst
file-keywords.rst
flow-keywords.rst userguide: clarify flow:stateless explanation 1 year ago
ftp-keywords.rst
header-keywords.rst doc: add note about big endian for icmp_seq match 1 year ago
http-keywords.rst
http2-keywords.rst http2: add frames support 1 year ago
ike-keywords.rst
index.rst doc/userguide: add noalert/alert keyword docs 1 year ago
integer-keywords.rst userguide: fix integer keyword matches list format 1 year ago
intro.rst pop3: protocol detection 2 years ago
ip-reputation-rules.rst doc/userguide: document iprep isset/isnotset 1 year ago
ipaddr.rst
ja-keywords.rst
kerberos-keywords.rst
lua-detection.rst doc: update lua sandbox docs for allowed packages/functions 2 years ago
meta.rst
modbus-keyword.rst
mqtt-keywords.rst detect/mqtt: move keywords to rust 1 year ago
multi-buffer-matching.rst doc: add description about tls.subjectaltname 2 years ago
nfs-keywords.rst
noalert.rst doc/userguide: add noalert/alert keyword docs 1 year ago
payload-keywords.rst detect: absent keyword to test absence of sticky buffer 12 months ago
prefilter-keywords.rst
quic-keywords.rst
rfb-keywords.rst detect/rfb: move keywords to rust 1 year ago
sip-keywords.rst doc: add new sip keywords 1 year ago
smb-keywords.rst
smtp-keywords.rst doc/userguide: fix rule container typo 1 year ago
snmp-keywords.rst detect/snmp: move keywords to rust 1 year ago
ssh-keywords.rst ssh: frames support 1 year ago
tag.rst
thresholding.rst doc/userguide: document threshold backoff type 1 year ago
tls-keywords.rst detect: add tls.alpn keyword 1 year ago
transforms.rst doc/transform: Correct typo 1 year ago
websocket-keywords.rst
xbits.rst detect/ssh: remove deprecated keywords 1 year ago