wazuh-documentation icon indicating copy to clipboard operation
wazuh-documentation copied to clipboard

Deprecated option used in the rule example

Open mauromalara opened this issue 2 years ago • 2 comments

Context

The documentation in v4.1 says that the same_source_ip option is deprecated since v3.13.0 and that from now on you have to use same_srcip. But the first example in the documentation in v4.2 uses the deprecated same_source_ip option.

4.1 screenshot

image

4.2 screenshot

image

Description

It is required to change the example for the docs after v3.13.0.

Link to documentation

https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/rules.html

mauromalara avatar Apr 28 '22 14:04 mauromalara

Related issue #4203

javimed avatar May 06 '22 18:05 javimed

Rule 3151, featured in the example, contains the same_source_ip label: https://github.com/wazuh/wazuh/blob/v4.3.1/ruleset/rules/0025-sendmail_rules.xml#L102. Currently, this labels works like an alias for same_scrip.

s-ocando avatar May 24 '22 09:05 s-ocando