makarov
The Suricata Rule Development module content uses legacy HTTP sticky buffer keywords (e.g. http_uri, http_header, http_client_body, etc.) instead of the current modifier-style sticky buffers introduced in Suricata 5+ (e.g.
http.uri
,
http.header
,
http.request_body
, etc.).
While the legacy syntax still works for backward compatibility, it is deprecated and no longer reflects current best practice or the official Suricata documentation. Students learning from this module may write rules using outdated conventions that diverge from what's expected in modern Suricata deployments and certification exams.
I suggest updating the module examples and exercises to use the current sticky buffer syntax, with a note on the legacy equivalents for context.