Web Protocol Contexts

http-authorization (CTS)

Matches the username and password decoded from the Authorization: Basic header in an HTTP request.

http-data (ANY)

Matches any HTTP data in an HTTP transaction that is not text/html, text/plain, or FORM values in a POST request.

http-first-data-chunk (ANY)

Matches the first data chunk in an HTTP transaction.

http-flash

Matches http payload when content type is flash video or application.

http-form-data (CTS)

Matches each of the form values in a POST request of an HTTP transaction.

http-get-url (CTS)

Matches the URL in an HTTP get request as it appears in the stream.

http-get-url-parsed (CTS)

Matches the decoded, normalized URL in an HTTP get request.

http-head-url (CTS)

Matches the URL in an HTTP head request as it appears in the stream.

http-head-url-parsed (CTS)

Matches the decoded, normalized URL in an HTTP head request.

http-header (ANY)

Matches any HTTP header.

http-header-accept (CTS)

Matches each Accept: header in an HTTP request.

http-header- accept-encoding (CTS)

Matches each Accept-Encoding: header in an HTTP request.

http-header- accept-language (CTS)

Matches each Accept-Language: header in an HTTP request.

http-header- content-encoding (ANY)

Matches each Content-Encoding: header in an HTTP transaction.

http-header- content-language (ANY)

Matches each Content-Language: header in an HTTP transaction.

http-header- content-location (ANY)

Matches each Content-Location: header in an HTTP transaction.

http-header- content-md5 (ANY)

Matches each Content-MD5: header in an HTTP transaction.

http-header- content-type (ANY)

Matches each Content-Type: header in an HTTP transaction.

http-header- cookie (ANY)

Matches each Cookie: header in an HTTP transaction.

http-header- host (CTS)

Matches each Host: header in an HTTP request.

http-header- referer (CTS)

Matches each Referrer: header in an HTTP request.

http-header- soapaction (ANY)

Matches each soapaction: header in an HTTP transaction.

http-header- user-agent (CTS)

Matches each User-Agent: header in an HTTP request.

http-header- x-forwarded-for

http-image (ANY)

Matches IMATE contents (BMP, PNG) in HTTP transaction.

http-jpeg-raw (ANY)

Matches JPEG content in HTTP transaction.

http-jpeg-tag (ANY)

Matches JPEG tag of JPEG content in HTTP transaction.

JPEG image files provide an area for applications to store metadata such as title, date taken, shutter speed, and so on. There are several slots available, each of which holds a group of metadata tags.

A JPEG file contains several segments; each segment contains different kinds of data, delimited by two-byte codes called markers. The markers are hexadecimal; they begin with 0xFF and end with a code (1 byte) indicating the kind of marker.

http-object-tag-clsid (STC)

Matches the CLSID of an object tag.

http-ole

Matches Microsofts OLE contents in HTTP transaction.

http-param-parsed (CTS)

Matches the decoded CGI parameters in an HTTP request.

http-pdf

Matches PDF contents in HTTP transaction.

http-png-chunk (ANY)

Matches contents of PNG chunk to HTTP transaction.

http-post-url (CTS)

Matches the URL in an HTTP post request as it appears in the stream.

HTTP POST URL

POST /index.html?crap=1085538798 HTTP/1.1

1.34. http-post-url pattern: ".*\?.*"

http-post-url-parsed (CTS)

Matches the decoded, normalized URL in an HTTP post request.

http-post-variable (CTS)

Matches each CGI variable in the form data of an HTTP POST request.

http-post- variable-parsed (CTS)

Matches each decoded CGI variable in the form data of an HTTP POST request.

http-request (CTS)

Matches each HTTP request line.

http-request-method (CTS)

Matches the method name in an HTTP request.

http-status (STC)

Matches the status line in an HTTP reply.

http-text-html (ANY)

Matches the text/html data in an HTTP transaction.

http-text-html-body (ANY)

Matches the body of text/html data in an HTTP tranaction

http-text-html-head (ANY)

Matches the header of text/html data in an HTTP transaction.

http-text-html-script (ANY)

Matches the script tag of text/html data in an HTTP transaction.

http-text-html-style (ANY)

Matches the style tag of text/html data in an HTTP transaction.

http-text-html-tag (ANY)

Matches any tag inside text/html data in an HTTP transaction.

http-text-plain (ANY)

Matches the text/plain data in an HTTP transaction.

http-text-soap (ANY)

Matches the text/soap data in and HTTP transaction.

http-text-xml (ANY)

Matches the tex/xml data in an HTTP transaction.

http-url (CTS)

Matches the URL in an HTTP request as it appears in the stream.

http-url-parsed (CTS)

Matches the decoded, normalized URL in an HTTP request.

http-url-parsed-param (CTS)

Matches the decoded, normalized URL in an HTTP request along with the CGI parameters, if any

http-url-parsed-param- parsed (CTS)

Matches the decoded, normalized URL in an HTTP request along with the decoded CGI parameters, if any

http-url-variable (CTS)

Matches each CGI variable in the URL of an HTTP GET request.

http-url- variable-parsed (CTS)

Matches each decoded CGI variable in the URL of an HTTP GET request.

http-variable (CTS)

Matches each CGI variable in an HTTP GET or POST request.

http-variable-parsed (CTS)

Matches each decoded CGI variable in an HTTP GET or POST request.

ssl-cert- common-name (ANY)

Matches the common name attribute of the SSL certificate.

ssl-cert- organization-name (ANY)

Matches the organization name in the SSL certificate.

ssl-cert- organizational-unit- name (ANY)

Matches the organizational unit name in the SSL certificate.

ssl-certificate (ANY)

Matches the entire SSL certificate content.

ssl-change-cipher-spec (ANY)

Matches the Change-Cipher-Spec Message Content

ssl-client-hello (CTS)

Matches SSL client hello message content.

ssl-client-key- exchange (CTS)

Matches SSL client key exchange message content.

ssl-client-version (CTS)

Matches the client SSL version.

ssl-selected- cipher-suite (STC)

Matches the selected cipher suite in the server hello message.

ssl-server-hello (STC)

Matches SSL server hello message content.

ssl-server- key-exchange (STC)

Matches SSL server key exchange message content.

ssl-server- version (STC)

Matches the SSL server version.