doc: add file.name information to smtp keyword doc

Signed-off-by: jason taylor <jtfas90@gmail.com>

diff --git a/doc/userguide/rules/index.rst b/doc/userguide/rules/index.rst
index 2715da79ac7db5be423f239531f6bb1abfcaa2a4..e174c6787bc51778b24e4b43abc372a66b2381ad 100644 (file)
--- a/doc/userguide/rules/index.rst
+++ b/doc/userguide/rules/index.rst
@@ -34,6 +34,7 @@ Suricata Rules
    http2-keywords
    quic-keywords
    nfs-keywords
+   smtp-keywords
    app-layer
    xbits
    thresholding

diff --git a/doc/userguide/rules/smtp-keywords.rst b/doc/userguide/rules/smtp-keywords.rst
new file mode 100644 (file)
index 0000000..ec91f6f
--- /dev/null
+++ b/doc/userguide/rules/smtp-keywords.rst
@@ -0,0 +1,19 @@
+SMTP Keywords
+=============
+
+.. role:: example-rule-options
+
+file.name
+---------
+
+The ``file.name`` keyword can be used at the SMTP application level. 
+
+Signature Example:
+
+.. container:: example-rule
+
+  alert smtp any any -> any any (msg:"SMTP file.name usage"; \
+  :example-rule-options:`file.name; content:"winmail.dat";` \
+  classtype:bad-unknown; sid:1; rev:1;)
+
+For additional information on the ``file.name`` keyword, see :doc:`file-keywords`.
\ No newline at end of file