Hello everyone i need write suricata rules trigger condition to both request and response. How i can do that ??.
Example:
Rule trigger when http response contains “ABC” and http request must contain “BCD”
You would likely write three rules for those two cases and combine them via flowbits see 8.11. Flow Keywords — Suricata 7.0.1-dev documentation for more details on how to use it.
Ideally add noalert to both rules where one would match the request and the other the response, to make sure they don’t get too noisy. The third rule would check the flowbits if both rules did set their part and alert if true.