# Is LDAP keyword available right now?

**URL:** <https://forum.suricata.io/t/is-ldap-keyword-available-right-now/5414>\
**Category:** Rules\
**Tags:** rules\
**Created:** [February 26, 2025, 12:52pm UTC](https://forum.suricata.io/t/is-ldap-keyword-available-right-now/5414 "2025-02-26T12:52:57Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![haoranli](https://avatars.discourse-cdn.com/v4/letter/h/aca169/32.png) [@haoranli](https://forum.suricata.io/u/haoranli)\
**Post date:** [February 26, 2025, 12:52pm UTC](https://forum.suricata.io/t/is-ldap-keyword-available-right-now/5414/1 "2025-02-26T12:52:57Z")

</div>

hello suricata team.  
I try to use ldap keyword in my ruleset. so I copy that rule from suricata document.

```auto
alert ldap any any -> any any (msg:"Test LDAP bind request"; ldap.request.operation:0; sid:1;)

```

but, I get an error when run suricata with this rule

```auto
Error: detect-parse: unknown rule keyword 'ldap.request.operation'. [SigParseOptions:detect-parse.c:898]
Error: detect: error parsing signature "alert ldap any any -> any any (msg:"Test LDAP bind request"; ldap.request.operation:0; sid:1;)" from file /var/lib/suricata/rules/suricata.rules at line 1047 [DetectLoadSigFile:detect-engine-loader.c:182]
Error: suricata: Loading signatures failed. [LoadSignatures:suricata.c:2409]

```

here is my suricata version

```auto
This is Suricata version 8.0.0-dev (11bf3e16e 2024-11-07)

```

---

<div class="post-metadata">

**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\
**Post date:** [February 26, 2025, 4:59pm UTC](https://forum.suricata.io/t/is-ldap-keyword-available-right-now/5414/2 "2025-02-26T16:59:25Z")

</div>

Hello there,

Could you please share the whole command you’ve used to run Suricata, and more of the output, not just the error?

I just tried using that same rule with one of the [LDAP pcaps](https://github.com/OISF/suricata-verify/tree/master/tests/ldap-search) we have in our Suricata-Verify testing suite, and that worked.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![haoranli](https://avatars.discourse-cdn.com/v4/letter/h/aca169/32.png) [@haoranli](https://forum.suricata.io/u/haoranli)\
**Post date:** [February 27, 2025, 1:33am UTC](https://forum.suricata.io/t/is-ldap-keyword-available-right-now/5414/3 "2025-02-27T01:33:18Z")

</div>

Thanks for your reply. the command is very simple:

```auto
sudo suricata -T

```

and full suricata.log content :

```auto
[383309 - Suricata-Main] 2025-02-27 09:32:07 Notice: suricata: This is Suricata version 8.0.0-dev (11bf3e16e 2024-11-07) running in SYSTEM mode
[383309 - Suricata-Main] 2025-02-27 09:32:07 Info: cpu: CPUs/cores online: 18
[383309 - Suricata-Main] 2025-02-27 09:32:07 Info: suricata: Running suricata under test mode
[383309 - Suricata-Main] 2025-02-27 09:32:07 Info: suricata: Setting engine mode to IDS mode by default
[383309 - Suricata-Main] 2025-02-27 09:32:07 Info: exception-policy: master exception-policy set to: auto
[383309 - Suricata-Main] 2025-02-27 09:32:07 Info: logopenfile: eve-log output device (regular) initialized: alert.json
[383309 - Suricata-Main] 2025-02-27 09:32:07 Info: logopenfile: eve-log output device (regular) initialized: flow.json
[383309 - Suricata-Main] 2025-02-27 09:32:07 Info: logopenfile: eve-log output device (regular) initialized: eve.json
[383309 - Suricata-Main] 2025-02-27 09:32:07 Info: logopenfile: stats output device (regular) initialized: stats.log
[383309 - Suricata-Main] 2025-02-27 09:32:07 Error: detect-parse: unknown rule keyword 'ldap.request.operation'.
[383309 - Suricata-Main] 2025-02-27 09:32:07 Error: detect: error parsing signature "alert ldap any any -> any any (msg:"Test LDAP bind request"; ldap.request.operation:0; sid:1;)" from file /var/lib/suricata/rules/suricata.rules at line 1047
[383309 - Suricata-Main] 2025-02-27 09:32:07 Info: detect: 9 rule files processed. 1553 rules successfully loaded, 1 rules failed, 0 rules skipped
[383309 - Suricata-Main] 2025-02-27 09:32:07 Error: suricata: Loading signatures failed.

```

---

<div class="post-metadata">

**Author:** ![haoranli](https://avatars.discourse-cdn.com/v4/letter/h/aca169/32.png) [@haoranli](https://forum.suricata.io/u/haoranli)\
**Post date:** [February 27, 2025, 1:41am UTC](https://forum.suricata.io/t/is-ldap-keyword-available-right-now/5414/4 "2025-02-27T01:41:39Z")

</div>

Sorry. I’m foolish 😅. I just pull latest suricata code and run it again. it works.!

---

<div class="post-metadata">

**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\
**Post date:** [February 27, 2025, 3:11pm UTC](https://forum.suricata.io/t/is-ldap-keyword-available-right-now/5414/5 "2025-02-27T15:11:51Z")

</div>

No foolishness! I see that I should also have noticed that the date of that 8 version was also prior to the merging of that keyword.

I’m glad you got it sorted out 🙂

---

<div class="post-metadata">

**Author:** ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)\
**Post date:** [March 4, 2025, 11:02am UTC](https://forum.suricata.io/t/is-ldap-keyword-available-right-now/5414/6 "2025-03-04T11:02:29Z")

</div>

Thanks @haoranli let us know which ldap keywords you would like in [Task #7452: ldap: add keywords to match output - Suricata - Open Information Security Foundation](https://redmine.openinfosecfoundation.org/issues/7452)