suricata-update
suricata-update copied to clipboard
matching: multi match support
Make sure these boxes are signed before submitting your Pull Request -- thank you.
- [x] I have read the contributing guide lines at https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Contributing
- [x] I have signed the Open Information Security Foundation contribution agreement at https://suricata-ids.org/about/contribution-agreement/
- [x] I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable)
This is an implementation of redmine 2509
Describe changes:
This is a resubmit of pr #37. After reworking to fit the 2023 code base.
It adds support to specify multiple conditions to match a rule.
Syntax:
multi:<match_condition1>;<match_condition2>;...<match_conditionN>;
Examples:
Match all rules including the term "nmap" but just from the "emerging-scan.rules" file.
multi:filename:rule/emerging-scan.rules; re:nmap;
Match all rules with a recent cve reference and a perimeter deployment
multi:re:cve-202[23];metadata: deployment perimeter;