doc/tls: add more detail on tls.random

diff --git a/doc/userguide/rules/tls-keywords.rst b/doc/userguide/rules/tls-keywords.rst
index 0db3e1c049b6412ee661b801c913e540b0352d34..f65689a067dc169c0b23edee3b3b61e4f6d043a9 100644 (file)
--- a/doc/userguide/rules/tls-keywords.rst
+++ b/doc/userguide/rules/tls-keywords.rst
@@ -261,7 +261,7 @@ You can specify several states with ``|`` (OR) to check for any of the specified
 tls.random
 ----------
 
-Matches on the 32 bytes of the TLS random field.
+Matches on the 32 bytes of the TLS random field from the client hello or server hello records.
 
 Example::
 
@@ -273,7 +273,7 @@ Example::
 tls.random_time
 ---------------
 
-Matches on the first 4 bytes of the TLS random field.
+Matches on the first 4 bytes of the TLS random field from the client hello or server hello records.
 
 Example::
 
@@ -285,7 +285,7 @@ Example::
 tls.random_bytes
 ----------------
 
-Matches on the last 28 bytes of the TLS random field.
+Matches on the last 28 bytes of the TLS random field from the client hello or server hello records.
 
 Example::