doc: update userguide meta classtype information

Signed-off-by: jason taylor <jtfas90@gmail.com>

diff --git a/doc/userguide/rules/meta.rst b/doc/userguide/rules/meta.rst
index e70948258f1c0fe808a95fde713fb413159c1b86..7e53763ce74e19619264fa03e82a27c8f5c4766e 100644 (file)
--- a/doc/userguide/rules/meta.rst
+++ b/doc/userguide/rules/meta.rst
@@ -89,17 +89,16 @@ classtype
 The classtype keyword gives information about the classification of
 rules and alerts. It consists of a short name, a long name and a
 priority. It can tell for example whether a rule is just informational
-or is about a hack etcetera. For each classtype, the
-classification.config has a priority which will be used in the rule.
+or is about a CVE. For each classtype, the classification.config has a priority which will be used in the rule.
 
 Example classtype definition::
 
   config classification: web-application-attack,Web Application Attack,1
   config classification: not-suspicious,Not Suspicious Traffic,3
 
-Now when we have defined this in the configuration, we can use the classtypes
+Now when we have defined the classification in the configuration file, we can use the classtypes
 in our rules. A rule with classtype web-application-attack will be assigned
-a priority of 1 and the alert will contain 'Web Application Attack':
+a priority of 1 and the alert will contain 'Web Application Attack' in the Suricata logs:
 
 =======================  ======================  ===========
 classtype                Alert                   Priority
@@ -108,7 +107,7 @@ web-application-attack   Web Application Attack  1
 not-suspicious           Not Suspicious Traffic  3
 =======================  ======================  ===========
 
-Our continuing example has also a classtype, this one of trojan-activity:
+Our continuing example also has a classtype: bad-unknown:
 
 .. container:: example-rule
 
@@ -117,8 +116,7 @@ Our continuing example has also a classtype, this one of trojan-activity:
 
 .. tip::
 
-    It is a convention that classtype comes before sid and rev and after
-    the rest of the keywords.
+    It is a standard practice in rule writing that the classtype keyword comes before the sid and rev keywords (as shown in the example rule).
 
 reference
 ---------