doc: improvement of xbits documentation page

diff --git a/doc/userguide/rules/xbits.rst b/doc/userguide/rules/xbits.rst
index 41049df1d14e512191552bae5bc7418778e6066d..ca48874f9ffd6e684b51e084065230be3f9c3f56 100644 (file)
--- a/doc/userguide/rules/xbits.rst
+++ b/doc/userguide/rules/xbits.rst
@@ -5,7 +5,7 @@ Set, unset, toggle and check for bits stored per host or ip_pair.
 
 Syntax::
 
-    xbits:<set|unset|isset|toggle>,<name>,track <ip_src|ip_dst|ip_pair>;
+    xbits:<set|unset|isset|isnotset|toggle>,<name>,track <ip_src|ip_dst|ip_pair>;
     xbits:<set|unset|isset|toggle>,<name>,track <ip_src|ip_dst|ip_pair> \
         [,expire <seconds>];
     xbits:<set|unset|isset|toggle>,<name>,track <ip_src|ip_dst|ip_pair> \
@@ -23,6 +23,8 @@ Notes
 
 -  To not alert, use ``noalert;``
 
+- the ``toggle`` option will flip the value of the xbits.
+
 -  See also:
 
    -  `https://blog.inliniac.net/2014/12/21/crossing-the-streams-in-suricata/ <https://blog.inliniac.net/2014/12/21/crossing-the-streams-in-suricata/>`_