{
  "summary": "DLP rules can now trigger their own action or tag directly off a YARA rule match by name (or any YARA hit at all), instead of only through the separate merge path that already existed - the two engines now share one rule surface for this. Firewall rules gain a new match type keyed on Suricata's own signature classification (e.g. trojan-activity, web-application-attack), kept distinct from the existing domain-category type so it's unambiguous which rule syntax applies; the admin UI now rejects a rule referencing a classification your loaded Suricata ruleset doesn't actually define, instead of silently accepting a rule that can never fire. Also removes a DLP rule option that let a connection's network fingerprint be treated as inspectable content - fingerprint-based scoping is still fully supported through the existing dedicated field, this only removes the redundant, conceptually mismatched second way of doing it. Fixes a firewall rules admin page bug where a rejected save could still show a success message while silently discarding the submitted changes."
}