A SOC analyst is writing a Suricata rule to detect HTTP POST requests to a specific URI path containing suspicious data. Which rule option correctly targets the normalized HTTP POST body?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because http.request_body is a Suricata sticky buffer keyword that targets the decoded HTTP request body, which is where POST data is found. A is wrong because http.uri targets the URI path, not the POST body content.
Full explanation below image
Full Explanation
B is correct because http.request_body is a Suricata sticky buffer keyword that targets the decoded HTTP request body, which is where POST data is found. A is wrong because http.uri targets the URI path, not the POST body content. C is wrong because http.header targets HTTP headers, not the request body. D is wrong because rawbytes is used to match on the raw, unprocessed packet bytes and bypasses application-layer normalization.