From: Eric Leblond <el@stamus-networks.com>
Date: Sun, 8 Jun 2025 07:05:13 +0000 (+0200)
Subject: doc/userguide: enrichment_key is now context_key
X-Git-Tag: suricata-8.0.0-rc1~33
X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=6236574b9c1b3b6a663bc0baec5b6f79d43dddb5;p=thirdparty%2Fsuricata.git

doc/userguide: enrichment_key is now context_key
---

diff --git a/doc/userguide/rules/datasets.rst b/doc/userguide/rules/datasets.rst
index 9ee6d53d86..eeb3912519 100644
--- a/doc/userguide/rules/datasets.rst
+++ b/doc/userguide/rules/datasets.rst
@@ -80,7 +80,7 @@ Syntax::
 
     dataset:<set|unset|isset|isnotset>,<name> \
         [, type <string|md5|sha256|ipv4|ip>, save <file name>, load <file name>, state <file name>, memcap <size>, hashsize <size>
-         , format <csv|json|ndjson>, enrichment_key <output_key>, value_key <json_key>, array_key <json_path>,
+         , format <csv|json|ndjson>, context_key <output_key>, value_key <json_key>, array_key <json_path>,
          remove_key];
 
 type <type>
@@ -100,7 +100,7 @@ format <type>
   the format of the file: csv, json. Defaut to csv. See
   :ref:`dataset with json format <datasets_json>` for json
   and ndjson option
-enrichment_key <key>
+context_key <key>
   the key to use for the enrichment of the alert event
   for json format
 value_key <key>
@@ -183,16 +183,16 @@ Syntax::
     dataset:<cmd>,<name>,<options>;
 
     dataset:<isset|isnotset>,<name> \
-        [, type <string|md5|sha256|ipv4|ip>, load <file name>, format <json|ndjson>, memcap <size>, hashsize <size>, enrichment_key <json_key> \
+        [, type <string|md5|sha256|ipv4|ip>, load <file name>, format <json|ndjson>, memcap <size>, hashsize <size>, context_key <json_key> \
          , value_key <json_key>, array_key <json_path>];
 
 Example rules could look like::
 
-    alert http any any -> any any (msg:"IP match"; ip.dst; dataset:isset,bad_ips, type ip, load bad_ips.json, format json, enrichment_key bad_ones, value_key ip; sid:8000001;)
+    alert http any any -> any any (msg:"IP match"; ip.dst; dataset:isset,bad_ips, type ip, load bad_ips.json, format json, context_key bad_ones, value_key ip; sid:8000001;)
 
 In this example, the match will occur if the destination IP is in the set and the
 alert will have an ``alert.content.bad_ones`` subobject that will contain the JSON
-data associated to the value (``bad_ones`` coming from ``enrichment_key`` option).
+data associated to the value (``bad_ones`` coming from ``context_key`` option).
 
 When format is ``json`` or ``ndjson``, the ``value_key`` is used to get
 the value in the line (``ndjson`` format) or in the array (``json`` format).
@@ -400,7 +400,7 @@ For example, if the file ``file.json`` is like the following example (typical of
 
 then the match to check the list of threats using dataset with JSON can be defined as ::
 
-    http.host; dataset:isset,threats,load file.json, enrichment_key threat, value_key host, array_key response.threats;
+    http.host; dataset:isset,threats,load file.json, context_key threat, value_key host, array_key response.threats;
 
 If the signature matches, it will result in an alert with the following ::