diff --git a/docs/doxygen-user/images/InterestingFiles/bomb_png.png b/docs/doxygen-user/images/InterestingFiles/bomb_png.png index 016ff5dea5..ab254f74f4 100644 Binary files a/docs/doxygen-user/images/InterestingFiles/bomb_png.png and b/docs/doxygen-user/images/InterestingFiles/bomb_png.png differ diff --git a/docs/doxygen-user/images/InterestingFiles/download_archive.png b/docs/doxygen-user/images/InterestingFiles/download_archive.png index aa457e929c..0021431e3c 100644 Binary files a/docs/doxygen-user/images/InterestingFiles/download_archive.png and b/docs/doxygen-user/images/InterestingFiles/download_archive.png differ diff --git a/docs/doxygen-user/images/InterestingFiles/if_new_rule.png b/docs/doxygen-user/images/InterestingFiles/if_new_rule.png index 826b2b1203..9164d20149 100644 Binary files a/docs/doxygen-user/images/InterestingFiles/if_new_rule.png and b/docs/doxygen-user/images/InterestingFiles/if_new_rule.png differ diff --git a/docs/doxygen-user/images/InterestingFiles/new_large_files.png b/docs/doxygen-user/images/InterestingFiles/new_large_files.png index a159f5af1f..313020c0a0 100644 Binary files a/docs/doxygen-user/images/InterestingFiles/new_large_files.png and b/docs/doxygen-user/images/InterestingFiles/new_large_files.png differ diff --git a/docs/doxygen-user/images/InterestingFiles/new_rule.png b/docs/doxygen-user/images/InterestingFiles/new_rule.png index 3385a402c0..e48460dee8 100644 Binary files a/docs/doxygen-user/images/InterestingFiles/new_rule.png and b/docs/doxygen-user/images/InterestingFiles/new_rule.png differ diff --git a/docs/doxygen-user/images/InterestingFiles/private_folder.png b/docs/doxygen-user/images/InterestingFiles/private_folder.png index 706bbeca57..f8ce78d2d4 100644 Binary files a/docs/doxygen-user/images/InterestingFiles/private_folder.png and b/docs/doxygen-user/images/InterestingFiles/private_folder.png differ diff --git a/docs/doxygen-user/ingest.dox b/docs/doxygen-user/ingest.dox index 594108ee07..9df3f724ff 100644 --- a/docs/doxygen-user/ingest.dox +++ b/docs/doxygen-user/ingest.dox @@ -50,7 +50,14 @@ The file filters panel can be opened from the ingest module selection panel or t \image html ingest-file-filters.PNG -Each filter contains one or more rules for selecting files based on a combination of file name, path, file size, and how recently the file was modified. Only one rule needs to match for the file to pass. Additionally, you can enter multiple comma-separated file extensions. All files will still be displayed in the tree view, but the ingest modules will only run on a subset. If we use the previous example and run the hash module, only files ending in .png will have their hash computed. +Each filter contains one or more rules for selecting files based on a combination of file name, path, file size, and how recently the file was modified. A file will match a rule set based on these conventions: + +Additionally, you can enter multiple comma-separated file extensions. All files will still be displayed in the tree view, but the ingest modules will only run on a subset. If we use the previous example and run the hash module, only files ending in .png will have their hash computed. \section ingest_profiles Using Ingest Profiles diff --git a/docs/doxygen-user/interesting_files.dox b/docs/doxygen-user/interesting_files.dox index 79d04ae86c..d1ea1e8d36 100644 --- a/docs/doxygen-user/interesting_files.dox +++ b/docs/doxygen-user/interesting_files.dox @@ -42,11 +42,17 @@ The buttons under the list of rules allow you to create new rules and edit or de \image html InterestingFiles/new_rule.png -The top line allows you to choose whether you want to match only files, only directories, or both. If you select directories or both, some of the condition types will be unavailable since they only apply to files. - Each rule must have at least one condition. To create conditions, check the box to the left of the condition you want to enable. The following is a description of each condition, with some full examples after.