suricata-update icon indicating copy to clipboard operation
suricata-update copied to clipboard

matching: multi match support

Open securitym0nkey opened this issue 1 year ago • 0 comments

Make sure these boxes are signed before submitting your Pull Request -- thank you.

  • [x] I have read the contributing guide lines at https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Contributing
  • [x] I have signed the Open Information Security Foundation contribution agreement at https://suricata-ids.org/about/contribution-agreement/
  • [x] I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable)

This is an implementation of redmine 2509

Describe changes:

This is a resubmit of pr #37. After reworking to fit the 2023 code base.

It adds support to specify multiple conditions to match a rule.

Syntax: multi:<match_condition1>;<match_condition2>;...<match_conditionN>;

Examples: Match all rules including the term "nmap" but just from the "emerging-scan.rules" file. multi:filename:rule/emerging-scan.rules; re:nmap;

Match all rules with a recent cve reference and a perimeter deployment multi:re:cve-202[23];metadata: deployment perimeter;

securitym0nkey avatar Jul 31 '23 12:07 securitym0nkey