[Oisf-users] full url in uri_path

[Erich Lerch]

Erik

Why not like this:

...;content:"<DOMAIN>";http_host; content:"<URI>";http_uri;...

Cheers,
Erich

2017-02-01 16:21 GMT+01:00 erik clark <philosnef at gmail.com>:
> I am trying to get the full uri (domain+uri) into a rule, but cant seem to
> be able to do this. I have tried http_raw_uri, http_uri, pcre://, but none
> seem to work. How can I force this in? Thanks!
>
>
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>