7. Suricata Rules

• 7.1. Rules Format
  • 7.1.1. Action
  • 7.1.2. Protocol
  • 7.1.3. Source and destination
  • 7.1.4. Ports (source and destination)
  • 7.1.5. Direction
  • 7.1.6. Rule options
    • 7.1.6.1. Modifier Keywords
    • 7.1.6.2. Normalized Buffers
• 7.2. Meta Keywords
  • 7.2.1. msg (message)
  • 7.2.2. sid (signature ID)
  • 7.2.3. rev (revision)
  • 7.2.4. gid (group ID)
  • 7.2.5. classtype
  • 7.2.6. reference
  • 7.2.7. priority
  • 7.2.8. metadata
  • 7.2.9. target
• 7.3. IP Keywords
  • 7.3.1. ttl
  • 7.3.2. ipopts
  • 7.3.3. sameip
  • 7.3.4. ip_proto
  • 7.3.5. ipv4.hdr
  • 7.3.6. ipv6.hdr
  • 7.3.7. id
  • 7.3.8. geoip
  • 7.3.9. fragbits (IP fragmentation)
  • 7.3.10. fragoffset
  • 7.3.11. tos
• 7.4. TCP keywords
  • 7.4.1. tcp.flags
  • 7.4.2. seq
  • 7.4.3. ack
  • 7.4.4. window
  • 7.4.5. tcp.mss
  • 7.4.6. tcp.hdr
• 7.5. UDP keywords
  • 7.5.1. udp.hdr
• 7.6. ICMP keywords
  • 7.6.1. itype
  • 7.6.2. icode
  • 7.6.3. icmp_id
  • 7.6.4. icmp_seq
  • 7.6.5. icmpv4.hdr
  • 7.6.6. icmpv6.hdr
  • 7.6.7. icmpv6.mtu
• 7.7. Payload Keywords
  • 7.7.1. content
  • 7.7.2. nocase
  • 7.7.3. depth
  • 7.7.4. startswith
  • 7.7.5. endswith
  • 7.7.6. offset
  • 7.7.7. distance
  • 7.7.8. within
  • 7.7.9. isdataat
  • 7.7.10. bsize
  • 7.7.11. dsize
  • 7.7.12. byte_test
  • 7.7.13. byte_math
  • 7.7.14. byte_jump
  • 7.7.15. byte_extract
  • 7.7.16. rpc
  • 7.7.17. replace
  • 7.7.18. pcre (Perl Compatible Regular Expressions)
    • 7.7.18.1. Suricata's modifiers
• 7.8. Transformations
  • 7.8.1. dotprefix
  • 7.8.2. strip_whitespace
  • 7.8.3. compress_whitespace
  • 7.8.4. to_md5
  • 7.8.5. to_sha1
  • 7.8.6. to_sha256
  • 7.8.7. pcrexform
  • 7.8.8. url_decode
• 7.9. Prefiltering Keywords
  • 7.9.1. fast_pattern
    • 7.9.1.1. Suricata Fast Pattern Determination Explained
      • 7.9.1.1.1. Appendices
        • 7.9.1.1.1.1. Appendix A - Buffers, list_id values, and Registration Order for Suricata 1.3.4
        • 7.9.1.1.1.2. Appendix B - Buffers, list_id values, Priorities, and Registration Order for Suricata 2.0.7
        • 7.9.1.1.1.3. Appendix C - Pattern Strength Algorithm
    • 7.9.1.2. fast_pattern:only
    • 7.9.1.3. fast_pattern:'chop'
  • 7.9.2. prefilter
• 7.10. Flow Keywords
  • 7.10.1. flowbits
  • 7.10.2. flow
  • 7.10.3. flowint
  • 7.10.4. stream_size
• 7.11. Bypass Keyword
  • 7.11.1. bypass
• 7.12. HTTP Keywords
  • 7.12.1. HTTP Primer
  • 7.12.2. http.method
  • 7.12.3. http.uri and http.uri.raw
  • 7.12.4. uricontent
  • 7.12.5. urilen
  • 7.12.6. http.protocol
  • 7.12.7. http.request_line
  • 7.12.8. http.header and http.header.raw
  • 7.12.9. http.cookie
  • 7.12.10. http.user_agent
    • 7.12.10.1. Notes
  • 7.12.11. http.accept
  • 7.12.12. http.accept_enc
  • 7.12.13. http.accept_lang
  • 7.12.14. http.connection
  • 7.12.15. http.content_type
  • 7.12.16. http.content_len
  • 7.12.17. http.referer
  • 7.12.18. http.start
  • 7.12.19. http.header_names
  • 7.12.20. http.request_body
  • 7.12.21. http.stat_code
  • 7.12.22. http.stat_msg
  • 7.12.23. http.response_line
  • 7.12.24. http.response_body
    • 7.12.24.1. Notes
  • 7.12.25. http.server
  • 7.12.26. http.location
  • 7.12.27. http.host and http.host.raw
    • 7.12.27.1. Notes
  • 7.12.28. file_data
    • 7.12.28.1. Notes
• 7.13. File Keywords
  • 7.13.1. file.data
  • 7.13.2. file.name
  • 7.13.3. fileext
  • 7.13.4. file.magic
  • 7.13.5. filestore
  • 7.13.6. filemd5
  • 7.13.7. filesha1
  • 7.13.8. filesha256
  • 7.13.9. filesize
• 7.14. DNS Keywords
  • 7.14.1. dns.opcode
    • 7.14.1.1. Syntax
    • 7.14.1.2. Examples
  • 7.14.2. dns.query
    • 7.14.2.1. Normalized Buffer
• 7.15. SSL/TLS Keywords
  • 7.15.1. tls.cert_subject
  • 7.15.2. tls.cert_issuer
  • 7.15.3. tls.cert_serial
  • 7.15.4. tls.cert_fingerprint
  • 7.15.5. tls.sni
  • 7.15.6. tls_cert_notbefore
  • 7.15.7. tls_cert_notafter
  • 7.15.8. tls_cert_expired
  • 7.15.9. tls_cert_valid
  • 7.15.10. tls.certs
  • 7.15.11. tls.version
  • 7.15.12. ssl_version
  • 7.15.13. tls.subject
  • 7.15.14. tls.issuerdn
  • 7.15.15. tls.fingerprint
  • 7.15.16. tls.store
  • 7.15.17. ssl_state
• 7.16. SSH Keywords
  • 7.16.1. ssh.proto
  • 7.16.2. ssh.software
  • 7.16.3. ssh.protoversion
  • 7.16.4. ssh.softwareversion
  • 7.16.5. ssh.hassh
  • 7.16.6. ssh.hassh.string
  • 7.16.7. ssh.hassh.server
  • 7.16.8. ssh.hassh.server.string
• 7.17. JA3 Keywords
  • 7.17.1. ja3.hash
  • 7.17.2. ja3.string
  • 7.17.3. ja3s.hash
  • 7.17.4. ja3s.string
• 7.18. Modbus Keyword
• 7.19. DNP3 Keywords
  • 7.19.1. dnp3_func
    • 7.19.1.1. Syntax
  • 7.19.2. dnp3_ind
    • 7.19.2.1. Syntax
    • 7.19.2.2. Examples
  • 7.19.3. dnp3_obj
    • 7.19.3.1. Syntax
  • 7.19.4. dnp3_data
    • 7.19.4.1. Syntax
    • 7.19.4.2. Example
• 7.20. ENIP/CIP Keywords
• 7.21. FTP/FTP-DATA Keywords
  • 7.21.1. ftpdata_command
  • 7.21.2. ftpbounce
• 7.22. Kerberos Keywords
  • 7.22.1. krb5_msg_type
  • 7.22.2. krb5_cname
  • 7.22.3. krb5_sname
  • 7.22.4. krb5_err_code
  • 7.22.5. krb5.weak_encryption (event)
  • 7.22.6. krb5.malformed_data (event)
• 7.23. SNMP keywords
  • 7.23.1. snmp.version
  • 7.23.2. snmp.community
  • 7.23.3. snmp.pdu_type
• 7.24. Base64 keywords
  • 7.24.1. base64_decode
  • 7.24.2. base64_data
  • 7.24.3. Example
• 7.25. SIP Keywords
  • 7.25.1. sip.method
    • 7.25.1.1. Syntax
    • 7.25.1.2. Examples
  • 7.25.2. sip.uri
    • 7.25.2.1. Syntax
    • 7.25.2.2. Examples
  • 7.25.3. sip.request_line
    • 7.25.3.1. Syntax
    • 7.25.3.2. Examples
  • 7.25.4. sip.stat_code
    • 7.25.4.1. Syntax
    • 7.25.4.2. Examples
  • 7.25.5. sip.stat_msg
    • 7.25.5.1. Syntax
    • 7.25.5.2. Examples
  • 7.25.6. sip.response_line
    • 7.25.6.1. Syntax
    • 7.25.6.2. Examples
  • 7.25.7. sip.protocol
    • 7.25.7.1. Syntax
    • 7.25.7.2. Example
• 7.26. RFB Keywords
  • 7.26.1. rfb.name
  • 7.26.2. rfb.secresult
  • 7.26.3. rfb.sectype
  • 7.26.4. Additional information
• 7.27. MQTT Keywords
  • 7.27.1. mqtt.protocol_version
  • 7.27.2. mqtt.type
  • 7.27.3. mqtt.flags
  • 7.27.4. mqtt.qos
  • 7.27.5. mqtt.reason_code
  • 7.27.6. mqtt.connack.session_present
  • 7.27.7. mqtt.connect.clientid
  • 7.27.8. mqtt.connect.flags
  • 7.27.9. mqtt.connect.password
  • 7.27.10. mqtt.connect.username
  • 7.27.11. mqtt.connect.willmessage
  • 7.27.12. mqtt.connect.willtopic
  • 7.27.13. mqtt.publish.message
  • 7.27.14. mqtt.publish.topic
  • 7.27.15. mqtt.subscribe.topic
  • 7.27.16. mqtt.unsubscribe.topic
  • 7.27.17. Additional information
• 7.28. HTTP2 Keywords
  • 7.28.1. http2.frametype
  • 7.28.2. http2.errorcode
  • 7.28.3. http2.priority
  • 7.28.4. http2.window
  • 7.28.5. http2.size_update
  • 7.28.6. http2.settings
  • 7.28.7. http2.header_name
  • 7.28.8. http2.header
  • 7.28.9. Additional information
• 7.29. Generic App Layer Keywords
  • 7.29.1. app-layer-protocol
    • 7.29.1.1. Bail out conditions
  • 7.29.2. app-layer-event
    • 7.29.2.1. Protocol Detection
      • 7.29.2.1.1. applayer_mismatch_protocol_both_directions
      • 7.29.2.1.2. applayer_wrong_direction_first_data
      • 7.29.2.1.3. applayer_detect_protocol_only_one_direction
      • 7.29.2.1.4. applayer_proto_detection_skipped
• 7.30. Xbits Keyword
  • 7.30.1. Notes
    • 7.30.1.1. YAML settings
    • 7.30.1.2. Threading
    • 7.30.1.3. Unix Socket
    • 7.30.1.4. Examples
      • 7.30.1.4.1. Creating a SSH blacklist
• 7.31. Thresholding Keywords
  • 7.31.1. threshold
    • 7.31.1.1. type "threshold"
    • 7.31.1.2. type "limit"
    • 7.31.1.3. type "both"
  • 7.31.2. detection_filter
• 7.32. IP Reputation Keyword
  • 7.32.1. iprep
    • 7.32.1.1. IP-only
• 7.33. Config Rules
  • 7.33.1. Keyword
  • 7.33.2. Action
• 7.34. Datasets
  • 7.34.1. Global config (optional)
  • 7.34.2. Rule keywords
    • 7.34.2.1. dataset
    • 7.34.2.2. datarep
  • 7.34.3. Rule Reloads
  • 7.34.4. Unix Socket
    • 7.34.4.1. dataset-add
    • 7.34.4.2. dataset-remove
  • 7.34.5. File formats
    • 7.34.5.1. data types
    • 7.34.5.2. dataset
    • 7.34.5.3. datarep
  • 7.34.6. File Locations
  • 7.34.7. Security
• 7.35. Lua Scripting
  • 7.35.1. Init function
  • 7.35.2. Match function
• 7.36. Differences From Snort
  • 7.36.1. Automatic Protocol Detection
  • 7.36.2. urilen Keyword
  • 7.36.3. http_uri Buffer
  • 7.36.4. http_header Buffer
  • 7.36.5. http_cookie Buffer
  • 7.36.6. New HTTP keywords
  • 7.36.7. byte_extract Keyword
  • 7.36.8. byte_math Keyword
  • 7.36.9. isdataat Keyword
  • 7.36.10. Relative PCRE
  • 7.36.11. tls* Keywords
  • 7.36.12. dns_query Keyword
  • 7.36.13. IP Reputation and iprep Keyword
  • 7.36.14. Flowbits
  • 7.36.15. flowbits:noalert;
  • 7.36.16. Negated Content Match Special Case
  • 7.36.17. File Extraction
  • 7.36.18. Lua Scripting
  • 7.36.19. Fast Pattern
  • 7.36.20. Don't Cross The Streams
  • 7.36.21. Alerts
  • 7.36.22. Buffer Reference Chart