summaryrefslogtreecommitdiff
path: root/doc/source/config.rst
diff options
context:
space:
mode:
authorjvoisin2023-11-26 18:49:14 +0100
committerjvoisin2023-11-26 18:49:14 +0100
commitefd086cc894c04a919b5e1b7729a1490f73d9231 (patch)
treea7a692e222ac3343ce231a3bbb99ca233d57c8f5 /doc/source/config.rst
parenta9b53d0b7e80a42b679cb83ef5946d79d73412d7 (diff)
Clarify a bit the documentation wrt. match/regex
This closes #468
Diffstat (limited to 'doc/source/config.rst')
-rw-r--r--doc/source/config.rst26
1 files changed, 13 insertions, 13 deletions
diff --git a/doc/source/config.rst b/doc/source/config.rst
index 67014ad..9781046 100644
--- a/doc/source/config.rst
+++ b/doc/source/config.rst
@@ -436,23 +436,23 @@ Filters
436 436
437- ``alias(description)``: human-readable ``description`` of the rule 437- ``alias(description)``: human-readable ``description`` of the rule
438- ``cidr(ip/mask)``: match on the client's `cidr <https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing>`_ 438- ``cidr(ip/mask)``: match on the client's `cidr <https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing>`_
439- ``filename(name)``: match in the file ``name`` 439- ``filename(name)``: exact match on the file's ``name``
440- ``filename_r(regexp)``: the file name matching the ``regexp`` 440- ``filename_r(regexp)``: file name matching the ``regexp``
441- ``function(name)``: match on function ``name`` 441- ``function(name)``: exact match on function ``name``
442- ``function_r(regexp)``: the function matching the ``regexp`` 442- ``function_r(regexp)``: function name matching the ``regexp``
443- ``hash(sha256)``: match on the file's `sha256 <https://en.wikipedia.org/wiki/SHA-2>`_ sum 443- ``hash(sha256)``: exact match on the file's `sha256 <https://en.wikipedia.org/wiki/SHA-2>`_ sum
444- ``line(line_number)``: match on the file's line. 444- ``line(line_number)``: exact match on the file's line.
445- ``param(name)``: match on the function's parameter ``name`` 445- ``param(name)``: exact match on the function's parameter ``name``
446- ``param_r(regexp)``: match on the function's parameter ``regexp`` 446- ``param_r(regexp)``: match on the function's parameter ``regexp``
447- ``param_type(type)``: match on the function's parameter ``type`` 447- ``param_type(type)``: exact match on the function's parameter ``type``
448- ``pos(nth_argument)``: match on the nth argument, starting from ``0`` 448- ``pos(nth_argument)``: exact match on the nth argument, starting from ``0``
449- ``ret(value)``: match on the function's return ``value`` 449- ``ret(value)``: exact match on the function's return ``value``
450- ``ret_r(regexp)``: match with a ``regexp`` on the function's return 450- ``ret_r(regexp)``: match with a ``regexp`` on the function's return
451- ``ret_type(type_name)``: match on the ``type_name`` of the function's return value 451- ``ret_type(type_name)``: match on the ``type_name`` of the function's return value
452- ``value(value)``: match on a literal ``value`` 452- ``value(value)``: exact match on a literal ``value``
453- ``value_r(regexp)``: match on a value matching the ``regexp`` 453- ``value_r(regexp)``: match on a value matching the ``regexp``
454- ``var(name)``: match on a **local variable** ``name`` 454- ``var(name)``: exact match on a **local variable** ``name``
455- ``key(name)``: match on the presence of ``name`` as a key in the hashtable 455- ``key(name)``: exact match on the presence of ``name`` as a key in the hashtable
456- ``key_r(regexp)``: match with ``regexp`` on keys in the hashtable 456- ``key_r(regexp)``: match with ``regexp`` on keys in the hashtable
457 457
458The ``type`` must be one of the following values: 458The ``type`` must be one of the following values: