[Oisf-users] full url in uri_path

[Sergey Malinkin]

So, it's work only for http sites

2017-02-01 18:41 GMT+03:00 Erich Lerch <erich.lerch at gmail.com>:

> Erik
>
> Why not like this:
>
> ...;content:"<DOMAIN>";http_host; content:"<URI>";http_uri;...
>
> Cheers,
> Erich
>
> 2017-02-01 16:21 GMT+01:00 erik clark <philosnef at gmail.com>:
> > I am trying to get the full uri (domain+uri) into a rule, but cant seem
> to
> > be able to do this. I have tried http_raw_uri, http_uri, pcre://, but
> none
> > seem to work. How can I force this in? Thanks!
> >
> >
> > _______________________________________________
> > Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> > Site: http://suricata-ids.org | Support: http://suricata-ids.org/
> support/
> > List: https://lists.openinfosecfoundation.org/
> mailman/listinfo/oisf-users
> >
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170203/c6f0d77f/attachment-0002.html>