doc: update http.accept keyword information

Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>

diff --git a/doc/userguide/rules/http-keywords.rst b/doc/userguide/rules/http-keywords.rst
index 58ba1f6ec323f8269b680a036d7d084de46a2cf6..398ed8a4634839a49cb22eddac1d0dc7afe74f3c 100644 (file)
--- a/doc/userguide/rules/http-keywords.rst
+++ b/doc/userguide/rules/http-keywords.rst
@@ -446,12 +446,24 @@ Example Duplicate User-Agent Header Request::
 http.accept
 -----------
 
-Sticky buffer to match on the HTTP Accept header. Only contains the header
-value. The \\r\\n after the header are not part of the buffer.
+The ``http.accept`` keyword is used to match on the Accept field that
+can be present in HTTP request headers.
 
-Example::
+It is possible to use any of the :doc:`payload-keywords` with the
+``http.accept`` keyword.
+
+Example HTTP Request::
+
+  GET /index.html HTTP/1.1
+  User-Agent: Mozilla/5.0
+  Accept: */*
+  Host: suricata.io
+
+.. container:: example-rule
 
-    alert http any any -> any any (http.accept; content:"image/gif"; sid:1;)
+  alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP Accept Example"; \
+  flow:established,to_server; :example-rule-options:`http.accept; 
+  content:"*/*";` bsize:3; classtype:bad-unknown; sid:91; rev:1;)
 
 .. _http.accept_enc: