doc: add file.name information to ftp keyword doc

Signed-off-by: jason taylor <jtfas90@gmail.com>

diff --git a/doc/userguide/rules/ftp-keywords.rst b/doc/userguide/rules/ftp-keywords.rst
index 068b14e33cc7a93098f9f8f6afc040b85b1cd0d0..0d25f6031213c2be9c254d90b062f0f9ea94e251 100644 (file)
--- a/doc/userguide/rules/ftp-keywords.rst
+++ b/doc/userguide/rules/ftp-keywords.rst
@@ -29,3 +29,15 @@ Detect FTP bounce attacks.
 Syntax::
 
   ftpbounce
+
+file.name
+---------
+
+The ``file.name`` keyword can be used at the FTP application level.
+
+Example::
+
+alert ftp-data any any -> any any (msg:"ftp layer file.name keyword usage"; \
+file.name; content:"file.txt"; classtype:bad-unknown; sid:1; rev:1;)
+
+For additional information on the ``file.name`` keyword, see :doc:`file-keywords`.
\ No newline at end of file