<div dir="ltr">So, it's work only for http sites<br></div><div class="gmail_extra"><br><div class="gmail_quote">2017-02-01 18:41 GMT+03:00 Erich Lerch <span dir="ltr"><<a href="mailto:erich.lerch@gmail.com" target="_blank">erich.lerch@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Erik<br>
<br>
Why not like this:<br>
<br>
...;content:"<DOMAIN>";http_<wbr>host; content:"<URI>";http_uri;...<br>
<br>
Cheers,<br>
Erich<br>
<div><div class="h5"><br>
2017-02-01 16:21 GMT+01:00 erik clark <<a href="mailto:philosnef@gmail.com">philosnef@gmail.com</a>>:<br>
> I am trying to get the full uri (domain+uri) into a rule, but cant seem to<br>
> be able to do this. I have tried http_raw_uri, http_uri, pcre://, but none<br>
> seem to work. How can I force this in? Thanks!<br>
><br>
><br>
</div></div>> ______________________________<wbr>_________________<br>
> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@<wbr>openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/<wbr>support/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/oisf-users</a><br>
><br>
______________________________<wbr>_________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@<wbr>openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/<wbr>support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/oisf-users</a><br>
</blockquote></div><br></div>