domains / families / security / suricata-rules-basics

suricata-rules-basics

separate

Core building blocks of Suricata signatures and multi-condition DPI logic

When to use

• Suricata signature building blocks
• multi-condition DPI logic
• rule anatomy
• content matching
• PCRE regex
• sticky buffers
• HTTP protocol buffers
• custom telemetry exfil rule composition

When not to use

• providing a full working rule

Skill page

Source