Detect count 5044 v2 #13902
Detect count 5044 v2 #13902
Conversation
enip.command is not a keyword nor an alias
Ticket: 7211 Allows to count the number of elements, without matching on individual elements
Ticket: 5044
catenacyber
requested review from
a team,
jasonish,
jufajardini and
victorjulien
as code owners
|
Information: QA ran without warnings. Pipeline = 27704 |
| without matching to a specific value. | ||
|
|
||
| The syntax is:: | ||
| keyword: count [mode] value; |
There was a problem hiding this comment.
Should we document the usages such as all, all1, nb etc that are also valid?
There was a problem hiding this comment.
There was a problem hiding this comment.
I had missed the TODO description in the PR, apologies.
jufajardini
left a comment
jufajardini
left a comment
There was a problem hiding this comment.
Curious: this looks different than what is discussed here https://redmine.openinfosecfoundation.org/issues/5044#note-2
Would there be a follow up to support that, or a decision to approach the feature differently?
Good catch, So, this PR is implementing the ticket title, what is discussed further (repeated pattern) should be another ticket... |
|
Waiting for #14064 to rebase |
ok. Should I create one? |
Not sure, the expressivity should be already reachable with PCRE... |
|
Continued in #14279 |
3 participants
Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/5044
Describe changes:
countoption to multi-buffers, behaving like a keyword but syntax isemail.received: count <3;instead ofemail.received; count: <3;all,all1andnbSV_BRANCH=OISF/suricata-verify#2634
Draft :
TODOs :