[Oisf-users] full url in uri_path

Erich Lerch erich.lerch at gmail.com
Wed Feb 1 15:41:23 UTC 2017


Why not like this:

...;content:"<DOMAIN>";http_host; content:"<URI>";http_uri;...


2017-02-01 16:21 GMT+01:00 erik clark <philosnef at gmail.com>:
> I am trying to get the full uri (domain+uri) into a rule, but cant seem to
> be able to do this. I have tried http_raw_uri, http_uri, pcre://, but none
> seem to work. How can I force this in? Thanks!
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users

More information about the Oisf-users mailing list