#include "suricata-common.h"
#include "suricata.h"
#include "decode.h"
#include "host.h"
#include "host-storage.h"
#include "detect.h"
#include "detect-parse.h"
#include "flow-var.h"
#include "decode-events.h"
#include "stream-tcp.h"
#include "detect-threshold.h"
#include "detect-engine-threshold.h"
#include "detect-engine-address.h"
#include "detect-engine-build.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-byte.h"
#include "util-debug.h"
#include "util-cpu.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-alert.h"
#include "util-time.h"
#include "util-hashlist.h"
#include "packet.h"
#include "action-globals.h"

Include dependency graph for detect-threshold.c:

#define	PARSE_REGEX_NAME "(track\|type\|count\|seconds\|multiplier)"

#define	PARSE_REGEX_VALUE "(limit\|both\|threshold\|backoff\|by_dst\|by_src\|by_both\|by_rule\|by_flow\|\\d+)"

#define	PARSE_REGEX

void	DetectThresholdRegister (void)
	Registration function for threshold: keyword.

DetectThresholdData *	DetectThresholdDataCopy (DetectThresholdData *de)
	Make a deep-copy of an extant DetectTHresholdData object.

Detailed Description

Author: Breno Silva breno.nosp@m..sil.nosp@m.va@gm.nosp@m.ail..nosp@m.com; Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Implements the threshold keyword.

The feature depends on what is provided by detect-engine-threshold.c and util-threshold-config.c

Definition in file detect-threshold.c.

Macro Definition Documentation

◆ PARSE_REGEX

#define PARSE_REGEX

Value:

    "^\\s*" PARSE_REGEX_NAME "\\s+" PARSE_REGEX_VALUE "\\s*,\\s*" PARSE_REGEX_NAME                 \
    "\\s+" PARSE_REGEX_VALUE "\\s*,\\s*" PARSE_REGEX_NAME "\\s+" PARSE_REGEX_VALUE                 \
    "\\s*,\\s*" PARSE_REGEX_NAME "\\s+" PARSE_REGEX_VALUE "\\s*"