Differences

This shows you the differences between two versions of the page.

--- pfsense:suricata:rules:breakdown_of_a_rule [2021/01/22 09:00] – peter
+++ pfsense:suricata:rules:breakdown_of_a_rule [2021/01/22 10:07] (current) – [Rule Options] peter
@@ Line 1: / Line 1: @@
 ====== PFSense - Suricata - Rules - Breakdown of a rule ======
 ===== Example Rule =====
@@ Line 15: / Line 14: @@
   * **(msg:"ICMP detected"; sid:2; rev:1;)**:  The options.
+----
 <WRAP info>
@@ Line 100: / Line 100: @@
 ===== Rule Options =====
+Options fall into different categories:
+  * **[[https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Meta-settings|meta-settings]]**:  Options not pertaining to any specifics about the packet; including msg, sid, rev.
+  * **[[https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Payload_keywords|payload]]**:  The packet data itself.  **content: "peter";**.
+  * **[[https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords|HTTP]]**:  Heavily used when TCP protocol is set, useful for using Suricata as a content filtering system.  **GET, POST, index.html, cookies, user-agents, response-status 302, 500 etc.**.
+  * **[[https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Flow-keywords|flow]]**:  More fine-grained control over the connection’s status and such.  **established, memory usage, timeouts, user logged in**.
+  * **[[https://redmine.openinfosecfoundation.org/projects/suricata/wiki/IPReputationRules|IP reputation]]**:   Is an IP legit or known to be associated with malware, spam, etc...
+----
 <code>