You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
suricata/doc/userguide/rules
Juliana Fajardini d5810a42e1 userguide: document how suricata processes rules
Added a page that explains how rules are prioritized by Suri, as well
as what main different types of inspection happen and what elements are
involved when ordering rules.

Task #5449
7 months ago
..
dataset-examples doc: add dataset examples 3 years ago
dns-keywords
fast-pattern
flow-keywords
header-keywords
http-keywords
intro
normalized-buffers
payload-keywords
pcre
rule-types userguide: explain rule types and categorization 1 year ago
app-layer.rst doc/devguide: document app-layer protocol detection 10 months ago
base64-keywords.rst detect: limit base64_decode `bytes` to 64KiB 1 year ago
bypass-keyword.rst doc: Update bypass docs to use new keyword format 1 year ago
config.rst detect/config: add flow tracking doc 11 months ago
datasets.rst doc/userguide: enrichment_key is now context_key 10 months ago
dcerpc-keywords.rst
decode-layer.rst doc/decode-events: new: unknown event description 1 year ago
dhcp-keywords.rst doc: integer keywords 2 years ago
differences-from-snort.rst lua: Remove luajit support 2 years ago
dnp3-keywords.rst
dns-keywords.rst detect/dns: support string for dns.rrtype 1 year ago
email-keywords.rst detect: add email.received keyword 1 year ago
enip-keyword.rst enip: convert to rust 2 years ago
fast-pattern-explained.rst doc: remove references to prehistoric versions 2 years ago
file-keywords.rst doc: integer keywords 2 years ago
flow-keywords.rst userguide: document how suricata processes rules 7 months ago
ftp-keywords.rst doc/ftp: Document ftp.completion_code sticky buffer 11 months ago
header-keywords.rst detect: add tcp.wscale keyword 11 months ago
http-keywords.rst userguide: document how suricata processes rules 7 months ago
http2-keywords.rst http2: add frames support 2 years ago
ike-keywords.rst doc: integer keywords 2 years ago
index.rst userguide: document how suricata processes rules 7 months ago
integer-keywords.rst detect/integers: support kibibyte unit 8 months ago
intro.rst detect: allow rule which need both directions to match 1 year ago
ip-reputation-rules.rst doc/userguide: document iprep isset/isnotset 2 years ago
ipaddr.rst doc: add reference to ipaddr in IP matching 4 years ago
ja-keywords.rst ja4: implement for TLS and QUIC 2 years ago
kerberos-keywords.rst doc: add multi buffer support note to keyword docs 3 years ago
ldap-keywords.rst detect: add ldap.responses.attribute_type 1 year ago
lua-detection.rst doc/lua-detection: fix example script; remove most buffers 9 months ago
mdns-keywords.rst mdns: add mdns parser, logger and detection 11 months ago
meta.rst userguide: document how suricata processes rules 7 months ago
modbus-keyword.rst
mqtt-keywords.rst detect/mqtt: move keywords to rust 2 years ago
multi-buffer-matching.rst doc: complete list of multi-buffers 8 months ago
nfs-keywords.rst doc: add file.name information to nfs keyword doc 2 years ago
noalert.rst doc/userguide: add noalert/alert keyword docs 2 years ago
payload-keywords.rst detect/entropy: Clarify when entropy is logged 10 months ago
pgsql-keywords.rst pgsql: add query keyword 11 months ago
prefilter-keywords.rst
quic-keywords.rst doc: add multi buffer support note to keyword docs 3 years ago
rfb-keywords.rst detect/rfb: move keywords to rust 2 years ago
rule-types.rst doc/rule-types: fix typo 11 months ago
rules-internals.rst userguide: document how suricata processes rules 7 months ago
sdp-keywords.rst doc/sdp: fix doc to match real keywords names 1 year ago
sip-keywords.rst doc: add new sip keywords 2 years ago
smb-keywords.rst detect: update smb.version keyword 2 years ago
smtp-keywords.rst detect/smtp: smtp.rcpt_to keyword 1 year ago
snmp-keywords.rst detect/snmp: move keywords to rust 2 years ago
ssh-keywords.rst doc/ssh: document hooks 1 year ago
tag.rst doc/userguide: add tag keyword page 2 years ago
thresholding.rst doc/threshold: Threshold keyword clarifications 1 year ago
tls-keywords.rst doc/tls: add more detail on tls.random 1 year ago
transforms.rst doc/from_base64: Emphasize keyword only values 8 months ago
vlan-keywords.rst detect: add vlan.layers keyword 1 year ago
websocket-keywords.rst app-layer: websockets protocol support 2 years ago
xbits.rst detect/ssh: remove deprecated keywords 2 years ago