From: jason taylor Date: Fri, 29 Dec 2023 11:59:29 +0000 (+0000) Subject: doc: remove legacy uricontent information X-Git-Tag: suricata-8.0.0-beta1~1553 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ef118aa582e35f4703b9d57610724d5d5b9a8e7f;p=thirdparty%2Fsuricata.git doc: remove legacy uricontent information ticket: 3025 Signed-off-by: jason taylor --- diff --git a/doc/userguide/rules/http-keywords.rst b/doc/userguide/rules/http-keywords.rst index 583e143fa5..093511ac04 100644 --- a/doc/userguide/rules/http-keywords.rst +++ b/doc/userguide/rules/http-keywords.rst @@ -205,28 +205,6 @@ Example Request:: Reference: `https://redmine.openinfosecfoundation.org/issues/2881 `_ -uricontent ----------- - -The ``uricontent`` keyword has the exact same effect as the -``http.uri`` sticky buffer. ``uricontent`` is a deprecated -(although still supported) way to match specifically and only on the -request URI buffer. - -Example of ``uricontent``: - -.. container:: example-rule - - alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Possible Vundo Trojan Variant reporting to Controller"; flow:established,to_server; content:"POST "; depth:5; :example-rule-emphasis:`uricontent:"/frame.html?";` urilen: > 80; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2009173; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Vundo; sid:2009173; rev:2;) - -The difference between ``http.uri`` and ``uricontent`` is the syntax: - - - -When authoring new rules, it is recommended that the ``http.uri`` -content sticky buffer be used rather than the deprecated ``uricontent`` -keyword. - .. _urilen: urilen