Listing of Suricata keywords with description and version information

Eric_Leblond · April 16, 2025, 8:30pm

suricata --list-keywords=csv is a really convenient commands that displays the list of keywords with description and link to the documentation.

One information that is missing is that is the version on which a keyword is available. And this is now available here in JSON and Markdown format:

github.com/StamusNetworks/suricata-language-server

suricatals/data/suricata-keywords.md

main

| name | description | app layer | features | documentation | initial_version | last_version |
|---|---|---|---|---|---|---|
| absent | test if the buffer is absent | Unset | none | [Doc](https://docs.suricata.io/en/suricata-8.0.0-beta1/rules/payload-keywords.html#absent) | 8.0.0 | 8.0.0 |
| ack | check for a specific TCP acknowledgement number | Unset | prefilter | [Doc](https://suricata.readthedocs.io/en/suricata-4.1.10/rules/header-keywords.html#ack) | 4.1.5 | 4.1.10 |
| alert | alert will be generated by the rule | Unset | No option | [Doc](https://docs.suricata.io/en/suricata-8.0.0-beta1/rules/noalert.html) | 7.0.7 | 8.0.0 |
| app-layer-event | match on events generated by the App Layer Parsers and the protocol detection engine | Unset | none | [Doc](https://docs.suricata.io/en/suricata-8.0.0-beta1/rules/app-layer.html#app-layer-event) | 4.1.5 | 8.0.0 |
| app-layer-protocol | match on the detected app-layer protocol | Unset | prefilter | [Doc](https://docs.suricata.io/en/suricata-8.0.0-beta1/rules/app-layer.html#app-layer-protocol) | 4.1.5 | 8.0.0 |
| app-layer-state | match on events generated by the App Layer Parsers and the protocol detection engine | Unset | none | [Doc](https://docs.suricata.io/en/suricata-8.0.0-beta1/rules/app-layer.html#app-layer-event) | 8.0.0 | 8.0.0 |
| asn1 |  | Unset | none | [Doc]() | 4.1.5 | 8.0.0 |
| base64_data | Content match base64 decoded data. | Unset | No option | [Doc](https://docs.suricata.io/en/suricata-8.0.0-beta1/rules/base64-keywords.html#base64-data) | 4.1.5 | 8.0.0 |
| base64_decode | Decodes base64 encoded data. | Unset | none | [Doc](https://docs.suricata.io/en/suricata-8.0.0-beta1/rules/base64-keywords.html#base64-decode) | 4.1.5 | 8.0.0 |
| bsize | match on the length of a buffer | Unset | none | [Doc](https://docs.suricata.io/en/suricata-8.0.0-beta1/rules/payload-keywords.html#bsize) | 4.1.5 | 8.0.0 |
| bypass | call the bypass callback when the match of a sig is complete | Unset | No option | [Doc](https://docs.suricata.io/en/suricata-8.0.0-beta1/rules/bypass-keyword.html) | 4.1.5 | 8.0.0 |
| byte_extract | extract <num of bytes> at a particular <offset> and store it in <var_name> | Unset | none | [Doc](https://docs.suricata.io/en/suricata-8.0.0-beta1/rules/payload-keywords.html#byte-extract) | 4.1.5 | 8.0.0 |
| byte_jump | allow the ability to select a <num of bytes> from an <offset> and move the detection pointer to that position | Unset | none | [Doc](https://docs.suricata.io/en/suricata-8.0.0-beta1/rules/payload-keywords.html#byte-jump) | 4.1.5 | 8.0.0 |
| byte_math |  | Unset | none | [Doc]() | 6.0.0 | 8.0.0 |
| byte_test | extract <num of bytes> and perform an operation selected with <operator> against the value in <test value> at a particular <offset> | Unset | none | [Doc](https://docs.suricata.io/en/suricata-8.0.0-beta1/rules/payload-keywords.html#byte-test) | 4.1.5 | 8.0.0 |
| cip_service | match on CIP Service, and optionnally class and attribute | Unset | none | [Doc](https://docs.suricata.io/en/suricata-8.0.0-beta1/rules/enip-keyword.html#cip_service) | 4.1.5 | 8.0.0 |
| classtype | information about the classification of rules and alerts | Unset | none | [Doc](https://docs.suricata.io/en/suricata-8.0.0-beta1/rules/meta.html#classtype) | 4.1.5 | 8.0.0 |
| compress_whitespace | modify buffer to compress consecutive whitespace characters into a single one before inspection | Unset | No option:transform | [Doc](https://docs.suricata.io/en/suricata-8.0.0-beta1/rules/transforms.html#compress-whitespace) | 4.1.5 | 8.0.0 |

This file has been truncated. show original

The information is also available in the new version of Suricata language server:

Topic		Replies	Views
App-layer protocol support for "smtp", but no SMTP keywords for rules? Rules rules	2	514	July 4, 2023
Unknown rule keyword 'flow.bytes_toserver' Help community , rules	3	213	May 2, 2024
June's webinar: Adding new rule keywords to Suricata: Live coding session Announcements webinar	3	767	June 20, 2023
Content filtering does not seem to work without other payload keywords Rules rules , suricata	3	267	April 4, 2024
Unknown rule keyword 'flow.pkts_toclient' Help rules	2	306	February 6, 2024

Listing of Suricata keywords with description and version information

Related topics