8. Suricata Rules
- 8.1. Rules Format
- 8.2. Meta Keywords
- 8.3. Ethernet Keywords
- 8.4. IP Keywords
- 8.5. TCP keywords
- 8.6. UDP keywords
- 8.7. ICMP keywords
- 8.8. IGMP keywords
- 8.9. Payload Keywords
- 8.9.1. content
- 8.9.2. nocase
- 8.9.3. depth
- 8.9.4. startswith
- 8.9.5. endswith
- 8.9.6. offset
- 8.9.7. distance
- 8.9.8. within
- 8.9.9. rawbytes
- 8.9.10. isdataat
- 8.9.11. absent
- 8.9.12. bsize
- 8.9.13. dsize
- 8.9.14. byte_test
- 8.9.15. byte_math
- 8.9.16. byte_jump
- 8.9.17. byte_extract
- 8.9.18. entropy
- 8.9.19. rpc
- 8.9.20. replace
- 8.9.21. pcre (Perl Compatible Regular Expressions)
- 8.10. Integer Keywords
- 8.11. Transformations
- 8.11.1. dotprefix
- 8.11.2. domain
- 8.11.3. tld
- 8.11.4. strip_whitespace
- 8.11.5. compress_whitespace
- 8.11.6. to_lowercase
- 8.11.7. to_md5
- 8.11.8. to_uppercase
- 8.11.9. to_sha1
- 8.11.10. to_sha256
- 8.11.11. pcrexform
- 8.11.12. url_decode
- 8.11.13. xor
- 8.11.14. header_lowercase
- 8.11.15. strip_pseudo_headers
- 8.11.16. from_base64
- 8.11.17. luaxform
- 8.11.18. gunzip
- 8.11.19. zlib_deflate
- 8.11.20. subslice
- 8.12. Prefiltering Keywords
- 8.13. Flow Keywords
- 8.14. Bypass Keyword
- 8.15. HTTP Keywords
- 8.15.1. HTTP Primer
- 8.15.2. Normalization
- 8.15.3. file.name
- 8.15.4. http.accept
- 8.15.5. http.accept_enc
- 8.15.6. http.accept_lang
- 8.15.7. http.host
- 8.15.8. http.host.raw
- 8.15.9. http.method
- 8.15.10. http.referer
- 8.15.11. http.request_body
- 8.15.12. http.request_header
- 8.15.13. http.request_line
- 8.15.14. http.uri
- 8.15.15. http.uri.raw
- 8.15.16. http.user_agent
- 8.15.17. urilen
- 8.15.18. http.location
- 8.15.19. http.response_body
- 8.15.20. http.response_header
- 8.15.21. http.response_line
- 8.15.22. http.server
- 8.15.23. http.stat_code
- 8.15.24. http.stat_msg
- 8.15.25. file.data
- 8.15.26. http.connection
- 8.15.27. http.content_len
- 8.15.28. http.content_type
- 8.15.29. http.cookie
- 8.15.30. http.header
- 8.15.31. http.header.raw
- 8.15.32. http.header_names
- 8.15.33. http.protocol
- 8.15.34. http.start
- 8.16. File Keywords
- 8.17. DNS Keywords
- 8.18. mDNS Keywords
- 8.19. LLMNR Keywords
- 8.20. SSL/TLS Keywords
- 8.20.1. tls.cert_subject
- 8.20.2. tls.cert_issuer
- 8.20.3. tls.cert_serial
- 8.20.4. tls.cert_fingerprint
- 8.20.5. tls.sni
- 8.20.6. tls.subjectaltname
- 8.20.7. tls_cert_notbefore
- 8.20.8. tls_cert_notafter
- 8.20.9. tls_cert_expired
- 8.20.10. tls_cert_valid
- 8.20.11. tls.certs
- 8.20.12. tls.version
- 8.20.13. ssl_version
- 8.20.14. tls.fingerprint
- 8.20.15. tls.store
- 8.20.16. ssl_state
- 8.20.17. tls.random
- 8.20.18. tls.random_time
- 8.20.19. tls.random_bytes
- 8.20.20. tls.cert_chain_len
- 8.20.21. tls.alpn
- 8.21. SSH Keywords
- 8.22. JA3/JA4 Keywords
- 8.23. Modbus Keyword
- 8.24. DCERPC Keywords
- 8.25. DHCP keywords
- 8.26. DNP3 Keywords
- 8.27. ENIP/CIP Keywords
- 8.27.1. enip_command
- 8.27.2. cip_service
- 8.27.3. enip.status
- 8.27.4. enip.protocol_version
- 8.27.5. enip.cip_attribute
- 8.27.6. enip.cip_instance
- 8.27.7. enip.cip_class
- 8.27.8. enip.cip_extendedstatus
- 8.27.9. enip.revision
- 8.27.10. enip.identity_status
- 8.27.11. enip.state
- 8.27.12. enip.serial
- 8.27.13. enip.product_code
- 8.27.14. enip.device_type
- 8.27.15. enip.vendor_id
- 8.27.16. enip.product_name
- 8.27.17. enip.service_name
- 8.27.18. enip.capabilities
- 8.27.19. enip.cip_status
- 8.28. FTP/FTP-DATA Keywords
- 8.29. Kerberos Keywords
- 8.30. SMB Keywords
- 8.31. SNMP keywords
- 8.32. NTP Keywords
- 8.33. Base64 keywords
- 8.34. SIP Keywords
- 8.35. SDP Keywords
- 8.35.1. sdp.origin
- 8.35.2. sdp.session_name
- 8.35.3. sdp.session_info
- 8.35.4. sdp.uri
- 8.35.5. sdp.email
- 8.35.6. sdp.phone_number
- 8.35.7. sdp.connection_data
- 8.35.8. sdp.bandwidth
- 8.35.9. sdp.time
- 8.35.10. sdp.repeat_time
- 8.35.11. sdp.timezone
- 8.35.12. sdp.encryption_key
- 8.35.13. sdp.attribute
- 8.35.14. sdp.media.media
- 8.35.15. sdp.media.session_info
- 8.35.16. sdp.media.connection_data
- 8.35.17. sdp.media.encryption_key
- 8.36. SCTP Keywords
- 8.37. RFB Keywords
- 8.38. MQTT Keywords
- 8.38.1. mqtt.protocol_version
- 8.38.2. mqtt.type
- 8.38.3. mqtt.flags
- 8.38.4. mqtt.qos
- 8.38.5. mqtt.reason_code
- 8.38.6. mqtt.connack.session_present
- 8.38.7. mqtt.connect.clientid
- 8.38.8. mqtt.connect.flags
- 8.38.9. mqtt.connect.password
- 8.38.10. mqtt.connect.protocol_string
- 8.38.11. mqtt.connect.username
- 8.38.12. mqtt.connect.willmessage
- 8.38.13. mqtt.connect.willtopic
- 8.38.14. mqtt.publish.message
- 8.38.15. mqtt.publish.topic
- 8.38.16. mqtt.subscribe.topic
- 8.38.17. mqtt.unsubscribe.topic
- 8.38.18. Additional information
- 8.39. IKE Keywords
- 8.40. HTTP2 Keywords
- 8.41. Quic Keywords
- 8.42. NFS Keywords
- 8.43. SMTP Keywords
- 8.44. WebSocket Keywords
- 8.45. Generic App Layer Keywords
- 8.46. Generic Decode Layer Keywords
- 8.47. Xbits Keyword
- 8.48. Alert Keywords
- 8.49. Thresholding Keywords
- 8.50. IP Reputation Keyword
- 8.51. IP Addresses Match
- 8.52. Config Rules
- 8.53. Datasets
- 8.54. Lua Scripting for Detection
- 8.55. Differences From Snort
- 8.55.1. Automatic Protocol Detection
- 8.55.2.
urilenKeyword - 8.55.3.
http_uriBuffer - 8.55.4.
http_headerBuffer - 8.55.5.
http_cookieBuffer - 8.55.6. New HTTP keywords
- 8.55.7.
byte_extractKeyword - 8.55.8.
byte_jumpKeyword - 8.55.9.
byte_mathKeyword - 8.55.10.
byte_testKeyword - 8.55.11.
isdataatKeyword - 8.55.12. Relative PCRE
- 8.55.13.
tls*Keywords - 8.55.14.
dns_queryKeyword - 8.55.15. IP Reputation and
iprepKeyword - 8.55.16. Flowbits
- 8.55.17. flowbits:noalert;
- 8.55.18. Negated Content Match Special Case
- 8.55.19. File Extraction
- 8.55.20. Lua Scripting
- 8.55.21. Fast Pattern
- 8.55.22. Don't Cross The Streams
- 8.55.23. Alerts
- 8.55.24. Buffer Reference Chart
- 8.56. Multiple Buffer Matching
- 8.57. Tag
- 8.58. VLAN Keywords
- 8.59. LDAP Keywords
- 8.59.1. LDAP Request and Response operations
- 8.59.2. ldap.request.operation
- 8.59.3. ldap.responses.operation
- 8.59.4. ldap.responses.count
- 8.59.5. ldap.request.dn
- 8.59.6. ldap.responses.dn
- 8.59.7. ldap.responses.result_code
- 8.59.8. ldap.responses.message
- 8.59.9. ldap.request.attribute_type
- 8.59.10. ldap.responses.attribute_type
- 8.60. PGSQL Keywords
- 8.61. Email Keywords
- 8.62. Rule Types and Categorization
- 8.62.1. Signature Properties
- 8.62.2. Signature Types and Variable-like Keywords
- 8.62.3. Signatures per Type
- 8.62.4. Detailed Flowcharts
- 8.63. Rule Processing