A Suricata rule fires on outbound HTTP traffic containing the string 'cmd.exe' in the URI. The rule uses the http.uri keyword. Which Suricata inspection engine processes this rule?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Suricata's http.uri keyword is a sticky buffer that references the normalized URI extracted by the application-layer HTTP inspector. A is wrong because packet decoders handle raw bytes before application-layer normalization.
Full explanation below image
Full Explanation
B is correct because Suricata's http.uri keyword is a sticky buffer that references the normalized URI extracted by the application-layer HTTP inspector. A is wrong because packet decoders handle raw bytes before application-layer normalization. C is wrong because the flow engine tracks session state but does not extract HTTP fields. D is wrong because the stream engine handles TCP reassembly, not HTTP field extraction.