From: jason taylor <jtfas90@gmail.com>
Date: Tue, 2 Jan 2024 21:04:03 +0000 (+0000)
Subject: doc: update http.request_line keyword information
X-Git-Tag: suricata-8.0.0-beta1~1550
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=292b3eb9b32838a239e4b30c009e0a7df65c010d;p=thirdparty%2Fsuricata.git

doc: update http.request_line keyword information

Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
---

diff --git a/doc/userguide/rules/http-keywords.rst b/doc/userguide/rules/http-keywords.rst
index 67821dc967..118137445f 100644
--- a/doc/userguide/rules/http-keywords.rst
+++ b/doc/userguide/rules/http-keywords.rst
@@ -280,11 +280,23 @@ Example HTTP Request::
 http.request_line
 -----------------
 
-The ``http.request_line`` forces the whole HTTP request line to be inspected.
+The ``http.request_line`` keyword is used to match on the entire contents of
+the HTTP request line.
 
-Example::
+Example HTTP Request::
+
+  GET /index.html HTTP/1.1
+  User-Agent: Mozilla/5.0
+  Host: suricata.io
+
+.. container:: example-rule
+
+  alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HTTP Request Example"; \
+  flow:established,to_server; :example-rule-options:`http.request_line; \
+  content:"GET /index.html HTTP/1.1";` bsize:24; classtype:bad-unknown; \
+  sid:60; rev:1;)
 
-    alert http any any -> any any (http.request_line; content:"GET / HTTP/1.0"; sid:1;)
+.. note:: ``http.request_line`` does not include the trailing \\r\\n
 
 .. _http.header: