Overview

• Overview

Getting Started

• Getting Started

Basic Syntax

• Syntax Rules of flow
• Syntax Rules of content
• nocase Keyword
• offset Keyword
• depth Keyword
• within Keyword
• distance Keyword
• fast_pattern Keyword
• isdataat and relative Keywords
• pkt_data and file_data
• PCRE Syntax
• tag Syntax
• ip and port Fields
• atk field
• kc filed

Numeric Detection

• Overview
• dsize Syntax Rules
• ssize Syntax Rules
• fsize Syntax Rules
• fast_value Syntax Rules

ByteTest Syntax

• byte_test Syntax Rules
• byte_jump Syntax Rules
• byte_extract Syntax Rules
• byte_math Syntax Rules

File Data Detection

• file_data Syntax Rules
• file_type Syntax Rules

Attack Evidence Collection Syntax

• Attack Evidence Collection Keyword log

Protocol Field

• Overview
• HTTP Fields
• FTP Fields
• DNS Fields
• SMTP Fields
• POP3 Fields
• IMAP Fields
• NetBIOS Fields
• SMB Fields
• MSRPC Fields
• RTSP Fields

Association detection

• association detection syntax rule