doc: add reference to ipaddr in IP matching

diff --git a/doc/userguide/rules/datasets.rst b/doc/userguide/rules/datasets.rst
index 0a5374d1c768436c5ddfbeceda9d914830e07660..5e08350b20c8a24ce2641a418ab83f4bed918967 100644 (file)
--- a/doc/userguide/rules/datasets.rst
+++ b/doc/userguide/rules/datasets.rst
@@ -1,3 +1,5 @@
+.. _datasets:
+
 Datasets
 ========
 

diff --git a/doc/userguide/rules/intro.rst b/doc/userguide/rules/intro.rst
index 8db71745432e8210aa7d5aca9550ed2f9bd34606..80e6919bfbd2e536d58e899de6db02b206f36bb6 100644 (file)
--- a/doc/userguide/rules/intro.rst
+++ b/doc/userguide/rules/intro.rst
@@ -166,6 +166,11 @@ $HOME_NET                           Your setting of HOME_NET in yaml
    You cannot write a signature using ``$EXTERNAL_NET`` because it evaluates to
    'not any', which is an invalid value.
 
+.. note::
+
+   Please note that the source and destination address can also be matched via the ``ip.src`` and ``ip.dst`` keywords (See :ref:`ipaddr`). These
+   keywords are mostly used in conjuction with the dataset feature (:ref:`datasets`).
+
 Ports (source and destination)
 ------------------------------
 .. container:: example-rule

diff --git a/doc/userguide/rules/ipaddr.rst b/doc/userguide/rules/ipaddr.rst
index a42657f326594b61f79a503c33309967497f9e4e..c4e1953b3cf0e6e3f81021facaf0142a9d1a1501 100644 (file)
--- a/doc/userguide/rules/ipaddr.rst
+++ b/doc/userguide/rules/ipaddr.rst
@@ -1,3 +1,5 @@
+.. _ipaddr:
+
 IP Addresses Match
 ==================