suricata-update
suricata-update copied to clipboard
Support for multiple conditions to match a rule
Make sure these boxes are signed before submitting your Pull Request -- thank you.
- [x] I have read the contributing guide lines at https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Contributing
- [x] have signed the Open Information Security Foundation contribution agreement at https://suricata-ids.org/about/contribution-agreement/
- [x] I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable)
Describe changes:
This adds support to specify multiple conditions to match a rule in {enable,disable}.conf.
Syntax: multi:<match_condition1>;<match_conditios2>;...<match_conditionN>;
Example: Enable all rules including the term "nmap" bust just from the "emerging-scan.rules" file.
multi:filename:rule/emerging-scan.rules; re:nmap;