From fba868a94e12d6b9ca671163a2da3365c619c909 Mon Sep 17 00:00:00 2001 From: jason taylor Date: Tue, 1 Aug 2023 15:34:08 +0000 Subject: [PATCH] doc: update file.magic information Signed-off-by: jason taylor --- doc/userguide/rules/file-keywords.rst | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/doc/userguide/rules/file-keywords.rst b/doc/userguide/rules/file-keywords.rst index ede6ba65ce..f33aba05d2 100644 --- a/doc/userguide/rules/file-keywords.rst +++ b/doc/userguide/rules/file-keywords.rst @@ -31,21 +31,33 @@ Example:: fileext:"jpg"; -filemagic ---------- +file.magic +---------- Matches on the information libmagic returns about a file. -Syntax:: +Example:: + + file.magic; content:"executable for MS Windows"; - filemagic:; +**Note** ``filemagic`` can still be used. The only difference between +``file.magic`` and ``file.magic`` is that ``filemagic`` assumes ``nocase`` +by default. In the example below the two signatures are considered +the same. Example:: filemagic:"executable for MS Windows"; -Note: as libmagic versions differ between installations, the returned -information may also slightly change. See also #437. + file.magic; content:"executable for MS Windows"; nocase; + +Note: Suricata currently uses its underlying operating systems +version/implementation of libmagic. Different versions and +implementations of libmagic do not return the same information. +Additionally there are varying Suricata performance impacts +based on the version and implementation of libmagic. +Additional information about Suricata and libmagic can be found +here: https://redmine.openinfosecfoundation.org/issues/437 filestore --------- -- 2.47.2