From e36a963196a77ec5b300f8ad992ebb91ea012d96 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 5 Sep 2019 10:59:33 +0200 Subject: [PATCH] datasets/doc: minor fixes and clarifications --- doc/userguide/rules/datasets.rst | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/doc/userguide/rules/datasets.rst b/doc/userguide/rules/datasets.rst index f66f610b2d..a32988ba67 100644 --- a/doc/userguide/rules/datasets.rst +++ b/doc/userguide/rules/datasets.rst @@ -8,7 +8,7 @@ For example, to match against a dns black list called ``dns-bl``:: dns.query; dataset:isset,dns-bl; -These keywords are aware of transforms. So to look up a DNS query again +These keywords are aware of transforms. So to look up a DNS query against a MD5 black list:: dns.query; to_md5; dataset:isset,dns-bl; @@ -53,12 +53,14 @@ Syntax:: type the data type: string, md5, sha256 save - file name for saving the in memory data when Suricata exits + file name for saving the in-memory data when Suricata exits load file name for load the data when Suricata starts up state sets both 'save' and 'load' to the same value +.. note:: 'load' or 'load' plus 'save' and 'state' cannot be mixed. + datarep ~~~~~~~ -- 2.47.2