From: Victor Julien Date: Thu, 5 Sep 2019 08:59:33 +0000 (+0200) Subject: datasets/doc: minor fixes and clarifications X-Git-Tag: suricata-5.0.0-rc1~90 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e36a963196a77ec5b300f8ad992ebb91ea012d96;p=thirdparty%2Fsuricata.git datasets/doc: minor fixes and clarifications --- diff --git a/doc/userguide/rules/datasets.rst b/doc/userguide/rules/datasets.rst index f66f610b2d..a32988ba67 100644 --- a/doc/userguide/rules/datasets.rst +++ b/doc/userguide/rules/datasets.rst @@ -8,7 +8,7 @@ For example, to match against a dns black list called ``dns-bl``:: dns.query; dataset:isset,dns-bl; -These keywords are aware of transforms. So to look up a DNS query again +These keywords are aware of transforms. So to look up a DNS query against a MD5 black list:: dns.query; to_md5; dataset:isset,dns-bl; @@ -53,12 +53,14 @@ Syntax:: type the data type: string, md5, sha256 save - file name for saving the in memory data when Suricata exits + file name for saving the in-memory data when Suricata exits load file name for load the data when Suricata starts up state sets both 'save' and 'load' to the same value +.. note:: 'load' or 'load' plus 'save' and 'state' cannot be mixed. + datarep ~~~~~~~