Suricata

Shivani Bhardwaj wrote:

The docs still cover the usage and examples of the deprecated keywords "http_cookie" and "http_method" but there is no mention that they have been replaced by "http.cookie" and "http.method" respectively.

Turns out this is the case with a lot of "http." keywords. List below:

Keyword                    Replaced by
========                 ===========
http_cookie               http.cookie
http_method            http.method
http_client_body      http.request_body
http_server_body    http.response_body
http_header             http.header
http_raw_header     http.header.raw
http_uri                     http.uri
http_raw_uri             http.uri.raw
http_stat_code         http.stat_code
http_user_agent      http.user_agent
http_host                  http.host
http_raw_host          http.host.raw

A discussion had here,https://github.com/OISF/suricata/pull/9509

It seems that a general revisit of the http-keywords.rst page is in order to remove confusing formatting/notations and generally update to remove legacy keywords since Suricata 4 is EOL.

this was completed in https://github.com/OISF/suricata/pull/10735