8. Suricata Rules

• 8.1. Rules Format
  • 8.1.1. Action
  • 8.1.2. Protocol
  • 8.1.3. Source and destination
  • 8.1.4. Ports (source and destination)
  • 8.1.5. Direction
  • 8.1.6. Rule options
    • 8.1.6.1. Modifier Keywords
    • 8.1.6.2. Normalized Buffers
• 8.2. Meta Keywords
  • 8.2.1. msg (message)
  • 8.2.2. sid (signature ID)
  • 8.2.3. rev (revision)
  • 8.2.4. gid (group ID)
  • 8.2.5. classtype
  • 8.2.6. reference
  • 8.2.7. priority
  • 8.2.8. metadata
  • 8.2.9. target
• 8.3. IP Keywords
  • 8.3.1. ttl
  • 8.3.2. ipopts
  • 8.3.3. sameip
  • 8.3.4. ip_proto
  • 8.3.5. ipv4.hdr
  • 8.3.6. ipv6.hdr
  • 8.3.7. id
  • 8.3.8. geoip
  • 8.3.9. fragbits (IP fragmentation)
  • 8.3.10. fragoffset
  • 8.3.11. tos
• 8.4. TCP keywords
  • 8.4.1. seq
  • 8.4.2. ack
  • 8.4.3. window
  • 8.4.4. tcp.mss
  • 8.4.5. tcp.hdr
• 8.5. UDP keywords
  • 8.5.1. udp.hdr
• 8.6. ICMP keywords
  • 8.6.1. itype
  • 8.6.2. icode
  • 8.6.3. icmp_id
  • 8.6.4. icmp_seq
  • 8.6.5. icmpv4.hdr
  • 8.6.6. icmpv6.hdr
  • 8.6.7. icmpv6.mtu
• 8.7. Payload Keywords
  • 8.7.1. content
  • 8.7.2. nocase
  • 8.7.3. depth
  • 8.7.4. startswith
  • 8.7.5. endswith
  • 8.7.6. offset
  • 8.7.7. distance
  • 8.7.8. within
  • 8.7.9. rawbytes
  • 8.7.10. isdataat
  • 8.7.11. bsize
  • 8.7.12. dsize
  • 8.7.13. byte_test
  • 8.7.14. byte_math
  • 8.7.15. byte_jump
  • 8.7.16. byte_extract
  • 8.7.17. rpc
  • 8.7.18. replace
  • 8.7.19. pcre (Perl Compatible Regular Expressions)
    • 8.7.19.1. Suricata's modifiers
• 8.8. Changes from PCRE1 to PCRE2
• 8.9. Transformations
  • 8.9.1. dotprefix
  • 8.9.2. strip_whitespace
  • 8.9.3. compress_whitespace
  • 8.9.4. to_md5
  • 8.9.5. to_sha1
  • 8.9.6. to_sha256
  • 8.9.7. pcrexform
  • 8.9.8. url_decode
  • 8.9.9. xor
• 8.10. Prefiltering Keywords
  • 8.10.1. fast_pattern
    • 8.10.1.1. Suricata Fast Pattern Determination Explained
      • 8.10.1.1.1. Appendices
        • 8.10.1.1.1.1. Appendix A - Buffers, list_id values, and Registration Order for Suricata 1.3.4
        • 8.10.1.1.1.2. Appendix B - Buffers, list_id values, Priorities, and Registration Order for Suricata 2.0.7
        • 8.10.1.1.1.3. Appendix C - Pattern Strength Algorithm
    • 8.10.1.2. fast_pattern:only
    • 8.10.1.3. fast_pattern:'chop'
  • 8.10.2. prefilter
• 8.11. Flow Keywords
  • 8.11.1. flowbits
  • 8.11.2. flow
  • 8.11.3. flowint
  • 8.11.4. stream_size
  • 8.11.5. flow.age
• 8.12. Bypass Keyword
  • 8.12.1. bypass
• 8.13. HTTP Keywords
  • 8.13.1. HTTP Primer
  • 8.13.2. http.method
  • 8.13.3. http.uri and http.uri.raw
  • 8.13.4. uricontent
  • 8.13.5. urilen
  • 8.13.6. http.protocol
  • 8.13.7. http.request_line
  • 8.13.8. http.header and http.header.raw
  • 8.13.9. http.cookie
  • 8.13.10. http.user_agent
    • 8.13.10.1. Notes
  • 8.13.11. http.accept
  • 8.13.12. http.accept_enc
  • 8.13.13. http.accept_lang
  • 8.13.14. http.connection
  • 8.13.15. http.content_type
  • 8.13.16. http.content_len
  • 8.13.17. http.referer
  • 8.13.18. http.start
  • 8.13.19. http.header_names
  • 8.13.20. http.request_body
  • 8.13.21. http.stat_code
  • 8.13.22. http.stat_msg
  • 8.13.23. http.response_line
  • 8.13.24. http.response_body
    • 8.13.24.1. Notes
  • 8.13.25. http.server
  • 8.13.26. http.location
  • 8.13.27. http.host and http.host.raw
  • 8.13.28. http.request_header
  • 8.13.29. http.response_header
    • 8.13.29.1. Notes
  • 8.13.30. file.data
    • 8.13.30.1. Notes
    • 8.13.30.2. Multiple Buffer Matching
• 8.14. File Keywords
  • 8.14.1. file.name
  • 8.14.2. fileext
  • 8.14.3. file.magic
  • 8.14.4. filestore
  • 8.14.5. filemd5
  • 8.14.6. filesha1
  • 8.14.7. filesha256
  • 8.14.8. filesize
• 8.15. DNS Keywords
  • 8.15.1. dns.opcode
    • 8.15.1.1. Syntax
    • 8.15.1.2. Examples
  • 8.15.2. dns.query
    • 8.15.2.1. Normalized Buffer
    • 8.15.2.2. Multiple Buffer Matching
• 8.16. SSL/TLS Keywords
  • 8.16.1. tls.cert_subject
    • 8.16.1.1. tls.subject
  • 8.16.2. tls.cert_issuer
    • 8.16.2.1. tls.issuerdn
  • 8.16.3. tls.cert_serial
  • 8.16.4. tls.cert_fingerprint
  • 8.16.5. tls.sni
  • 8.16.6. tls_cert_notbefore
  • 8.16.7. tls_cert_notafter
  • 8.16.8. tls_cert_expired
  • 8.16.9. tls_cert_valid
  • 8.16.10. tls.certs
  • 8.16.11. tls.version
  • 8.16.12. ssl_version
  • 8.16.13. tls.fingerprint
  • 8.16.14. tls.store
  • 8.16.15. ssl_state
  • 8.16.16. tls.random
  • 8.16.17. tls.random_time
  • 8.16.18. tls.random_bytes
• 8.17. SSH Keywords
  • 8.17.1. ssh.proto
  • 8.17.2. ssh.software
  • 8.17.3. ssh.protoversion
  • 8.17.4. ssh.softwareversion
  • 8.17.5. ssh.hassh
  • 8.17.6. ssh.hassh.string
  • 8.17.7. ssh.hassh.server
  • 8.17.8. ssh.hassh.server.string
• 8.18. JA3 Keywords
  • 8.18.1. ja3.hash
  • 8.18.2. ja3.string
  • 8.18.3. ja3s.hash
  • 8.18.4. ja3s.string
• 8.19. Modbus Keyword
• 8.20. DCERPC Keywords
  • 8.20.1. dcerpc.iface
  • 8.20.2. dcerpc.opnum
  • 8.20.3. dcerpc.stub_data
  • 8.20.4. Additional information
• 8.21. DHCP keywords
  • 8.21.1. dhcp.leasetime
  • 8.21.2. dhcp.rebinding_time
  • 8.21.3. dhcp.renewal_time
• 8.22. DNP3 Keywords
  • 8.22.1. dnp3_func
    • 8.22.1.1. Syntax
  • 8.22.2. dnp3_ind
    • 8.22.2.1. Syntax
    • 8.22.2.2. Examples
  • 8.22.3. dnp3_obj
    • 8.22.3.1. Syntax
  • 8.22.4. dnp3_data
    • 8.22.4.1. Syntax
    • 8.22.4.2. Example
• 8.23. ENIP/CIP Keywords
• 8.24. FTP/FTP-DATA Keywords
  • 8.24.1. ftpdata_command
  • 8.24.2. ftpbounce
• 8.25. Kerberos Keywords
  • 8.25.1. krb5_msg_type
  • 8.25.2. krb5_cname
  • 8.25.3. krb5_sname
  • 8.25.4. krb5_err_code
  • 8.25.5. krb5.weak_encryption (event)
  • 8.25.6. krb5.malformed_data (event)
  • 8.25.7. krb5.ticket_encryption
• 8.26. SMB Keywords
  • 8.26.1. smb.named_pipe
  • 8.26.2. smb.share
  • 8.26.3. smb.ntlmssp_user
  • 8.26.4. smb.ntlmssp_domain
• 8.27. SNMP keywords
  • 8.27.1. snmp.version
  • 8.27.2. snmp.community
  • 8.27.3. snmp.usm
  • 8.27.4. snmp.pdu_type
• 8.28. Base64 keywords
  • 8.28.1. base64_decode
  • 8.28.2. base64_data
  • 8.28.3. Example
• 8.29. SIP Keywords
  • 8.29.1. sip.method
    • 8.29.1.1. Syntax
    • 8.29.1.2. Examples
  • 8.29.2. sip.uri
    • 8.29.2.1. Syntax
    • 8.29.2.2. Examples
  • 8.29.3. sip.request_line
    • 8.29.3.1. Syntax
    • 8.29.3.2. Examples
  • 8.29.4. sip.stat_code
    • 8.29.4.1. Syntax
    • 8.29.4.2. Examples
  • 8.29.5. sip.stat_msg
    • 8.29.5.1. Syntax
    • 8.29.5.2. Examples
  • 8.29.6. sip.response_line
    • 8.29.6.1. Syntax
    • 8.29.6.2. Examples
  • 8.29.7. sip.protocol
    • 8.29.7.1. Syntax
    • 8.29.7.2. Example
• 8.30. RFB Keywords
  • 8.30.1. rfb.name
  • 8.30.2. rfb.secresult
  • 8.30.3. rfb.sectype
  • 8.30.4. Additional information
• 8.31. MQTT Keywords
  • 8.31.1. mqtt.protocol_version
  • 8.31.2. mqtt.type
  • 8.31.3. mqtt.flags
  • 8.31.4. mqtt.qos
  • 8.31.5. mqtt.reason_code
  • 8.31.6. mqtt.connack.session_present
  • 8.31.7. mqtt.connect.clientid
  • 8.31.8. mqtt.connect.flags
  • 8.31.9. mqtt.connect.password
  • 8.31.10. mqtt.connect.username
  • 8.31.11. mqtt.connect.willmessage
  • 8.31.12. mqtt.connect.willtopic
  • 8.31.13. mqtt.publish.message
  • 8.31.14. mqtt.publish.topic
  • 8.31.15. mqtt.subscribe.topic
  • 8.31.16. mqtt.unsubscribe.topic
  • 8.31.17. Additional information
• 8.32. IKE Keywords
  • 8.32.1. ike.init_spi, ike.resp_spi
  • 8.32.2. ike.chosen_sa_attribute
  • 8.32.3. ike.exchtype
  • 8.32.4. ike.vendor
  • 8.32.5. ike.key_exchange_payload
  • 8.32.6. ike.key_exchange_payload_length
  • 8.32.7. ike.nonce_payload
  • 8.32.8. ike.nonce_payload_length
  • 8.32.9. Additional information
• 8.33. HTTP2 Keywords
  • 8.33.1. http2.frametype
  • 8.33.2. http2.errorcode
  • 8.33.3. http2.priority
  • 8.33.4. http2.window
  • 8.33.5. http2.size_update
  • 8.33.6. http2.settings
  • 8.33.7. http2.header_name
  • 8.33.8. Additional information
• 8.34. Quic Keywords
  • 8.34.1. quic.cyu.hash
  • 8.34.2. quic.cyu.string
  • 8.34.3. quic.version
  • 8.34.4. Additional information
• 8.35. Generic App Layer Keywords
  • 8.35.1. app-layer-protocol
    • 8.35.1.1. Bail out conditions
  • 8.35.2. app-layer-event
    • 8.35.2.1. Protocol Detection
      • 8.35.2.1.1. applayer_mismatch_protocol_both_directions
      • 8.35.2.1.2. applayer_wrong_direction_first_data
      • 8.35.2.1.3. applayer_detect_protocol_only_one_direction
      • 8.35.2.1.4. applayer_proto_detection_skipped
• 8.36. Xbits Keyword
  • 8.36.1. Notes
    • 8.36.1.1. YAML settings
    • 8.36.1.2. Threading
    • 8.36.1.3. Unix Socket
    • 8.36.1.4. Examples
      • 8.36.1.4.1. Creating a SSH blacklist
• 8.37. Thresholding Keywords
  • 8.37.1. threshold
    • 8.37.1.1. type "threshold"
    • 8.37.1.2. type "limit"
    • 8.37.1.3. type "both"
  • 8.37.2. detection_filter
• 8.38. IP Reputation Keyword
  • 8.38.1. iprep
    • 8.38.1.1. IP-only
• 8.39. IP Addresses Match
  • 8.39.1. ip.src
  • 8.39.2. ip.dst
• 8.40. Config Rules
  • 8.40.1. Keyword
  • 8.40.2. Action
• 8.41. Datasets
  • 8.41.1. Global config (optional)
  • 8.41.2. Rule keywords
    • 8.41.2.1. dataset
    • 8.41.2.2. datarep
  • 8.41.3. Rule Reloads
  • 8.41.4. Unix Socket
    • 8.41.4.1. dataset-add
    • 8.41.4.2. dataset-remove
    • 8.41.4.3. dataset-clear
    • 8.41.4.4. dataset-lookup
    • 8.41.4.5. dataset-dump
  • 8.41.5. File formats
    • 8.41.5.1. data types
    • 8.41.5.2. dataset
    • 8.41.5.3. datarep
  • 8.41.6. File Locations
  • 8.41.7. Security
• 8.42. Lua Scripting for Detection
  • 8.42.1. Init function
  • 8.42.2. Match function
• 8.43. Differences From Snort
  • 8.43.1. Automatic Protocol Detection
  • 8.43.2. urilen Keyword
  • 8.43.3. http_uri Buffer
  • 8.43.4. http_header Buffer
  • 8.43.5. http_cookie Buffer
  • 8.43.6. New HTTP keywords
  • 8.43.7. byte_extract Keyword
  • 8.43.8. byte_jump Keyword
  • 8.43.9. byte_math Keyword
  • 8.43.10. byte_test Keyword
  • 8.43.11. isdataat Keyword
  • 8.43.12. Relative PCRE
  • 8.43.13. tls* Keywords
  • 8.43.14. dns_query Keyword
  • 8.43.15. IP Reputation and iprep Keyword
  • 8.43.16. Flowbits
  • 8.43.17. flowbits:noalert;
  • 8.43.18. Negated Content Match Special Case
  • 8.43.19. File Extraction
  • 8.43.20. Lua Scripting
  • 8.43.21. Fast Pattern
  • 8.43.22. Don't Cross The Streams
  • 8.43.23. Alerts
  • 8.43.24. Buffer Reference Chart
• 8.44. Multiple Buffer Matching