golden hour

/usr/share/vim/vim82/syntax

File/Folder	Size	Actions
2html.vim	73.65 KB
8th.vim	28.02 KB
README.txt	1.37 KB
a2ps.vim	2.37 KB
a65.vim	6.24 KB
aap.vim	5.56 KB
abap.vim	8.94 KB
abaqus.vim	1.07 KB
abc.vim	1.8 KB
abel.vim	4.99 KB
acedb.vim	4.76 KB
ada.vim	12.74 KB
aflex.vim	4.27 KB
ahdl.vim	2.71 KB
aidl.vim	629 B
alsaconf.vim	1.51 KB
amiga.vim	2.9 KB
aml.vim	23.57 KB
ampl.vim	4.01 KB
ant.vim	5.68 KB
antlr.vim	1.75 KB
apache.vim	15.01 KB
apachestyle.vim	1.38 KB
aptconf.vim	21.71 KB
arch.vim	1.12 KB
arduino.vim	1.98 KB
art.vim	1.27 KB
asciidoc.vim	10.88 KB
asm.vim	5.9 KB
asm68k.vim	13.95 KB
asmh8300.vim	1.68 KB
asn.vim	2.52 KB
aspperl.vim	811 B
aspvbs.vim	8.89 KB
asterisk.vim	5.5 KB
asteriskvm.vim	2.28 KB
atlas.vim	2.54 KB
autodoc.vim	3.64 KB
autohotkey.vim	11.58 KB
autoit.vim	46.89 KB
automake.vim	3.85 KB
ave.vim	1.86 KB
avra.vim	2.62 KB
awk.vim	8 KB
ayacc.vim	2.52 KB
b.vim	4.79 KB
baan.vim	71.87 KB
bash.vim	371 B
basic.vim	8.11 KB
bc.vim	1.75 KB
bdf.vim	3.75 KB
bib.vim	5.86 KB
bindzone.vim	4.79 KB
blank.vim	794 B
bsdl.vim	377 B
bst.vim	2.76 KB
btm.vim	9.07 KB
bzl.vim	374 B
bzr.vim	1.52 KB
c.vim	26.99 KB
cabal.vim	7.19 KB
cabalconfig.vim	1.15 KB
cabalproject.vim	944 B
calendar.vim	4.92 KB
catalog.vim	921 B
cdl.vim	3.02 KB
cdrdaoconf.vim	3.56 KB
cdrtoc.vim	22.22 KB
cf.vim	18.21 KB
cfg.vim	1.32 KB
ch.vim	922 B
chaiscript.vim	2.82 KB
change.vim	901 B
changelog.vim	2.05 KB
chaskell.vim	333 B
cheetah.vim	1.71 KB
chicken.vim	2.56 KB
chill.vim	7.84 KB
chordpro.vim	2.46 KB
cl.vim	3.81 KB
clean.vim	3.08 KB
clipper.vim	5.45 KB
clojure.vim	45.4 KB
cmake.vim	41.16 KB
cmod.vim	6.12 KB
cmusrc.vim	12.62 KB
cobol.vim	13.27 KB
coco.vim	1.27 KB
colortest.vim	3.13 KB
conaryrecipe.vim	7.85 KB
conf.vim	799 B
config.vim	2.03 KB
context.vim	6.05 KB
cpp.vim	3.5 KB
crm.vim	1.17 KB
crontab.vim	2.16 KB
cs.vim	10.69 KB
csc.vim	8.25 KB
csdl.vim	23.2 KB
csh.vim	6.31 KB
csp.vim	6.98 KB
css.vim	32.17 KB
cterm.vim	6.26 KB
ctrlh.vim	688 B
cucumber.vim	31.14 KB
cuda.vim	2.63 KB
cupl.vim	3.78 KB
cuplsim.vim	1.87 KB
cvs.vim	882 B
cvsrc.vim	1.22 KB
cweb.vim	2.82 KB
cynlib.vim	2.49 KB
cynpp.vim	1.23 KB
d.vim	27.96 KB
dart.vim	3.21 KB
datascript.vim	3.72 KB
dcd.vim	1.76 KB
dcl.vim	6.23 KB
debchangelog.vim	3.35 KB
debcontrol.vim	8.52 KB
debcopyright.vim	1.11 KB
debsources.vim	2.15 KB
def.vim	1.07 KB
denyhosts.vim	7.19 KB
desc.vim	3 KB
desktop.vim	9.13 KB
dictconf.vim	3.04 KB
dictdconf.vim	6.31 KB
diff.vim	17.01 KB
dircolors.vim	6.78 KB
dirpager.vim	1.75 KB
diva.vim	4.63 KB
django.vim	3.84 KB
dns.vim	132 B
dnsmasq.vim	9.83 KB
docbk.vim	10.08 KB
docbksgml.vim	193 B
docbkxml.vim	191 B
dockerfile.vim	2.42 KB
dosbatch.vim	6.11 KB
dosini.vim	1.24 KB
dot.vim	2.95 KB
doxygen.vim	38 KB
dracula.vim	2.61 KB
dsl.vim	1.28 KB
dtd.vim	4.89 KB
dtml.vim	16.22 KB
dtrace.vim	6.29 KB
dts.vim	1.18 KB
dune.vim	1.9 KB
dylan.vim	3.33 KB
dylanintr.vim	1.05 KB
dylanlid.vim	664 B
ecd.vim	1.2 KB
edif.vim	1.25 KB
eiffel.vim	6.76 KB
elf.vim	2.29 KB
elinks.vim	10.25 KB
elm.vim	3.57 KB
elmfilt.vim	2.83 KB
erlang.vim	10.87 KB
eruby.vim	3.22 KB
esmtprc.vim	938 B
esqlc.vim	2.04 KB
esterel.vim	2.98 KB
eterm.vim	18.72 KB
euphoria3.vim	5.96 KB
euphoria4.vim	14.2 KB
eviews.vim	4.89 KB
exim.vim	17.66 KB
expect.vim	3.65 KB
exports.vim	1.71 KB
falcon.vim	11.73 KB
fan.vim	5.32 KB
fasm.vim	8.55 KB
fdcc.vim	5.52 KB
fetchmail.vim	3.23 KB
fgl.vim	7.1 KB
flexwiki.vim	5.31 KB
focexec.vim	3.44 KB
form.vim	6.24 KB
forth.vim	10.42 KB
fortran.vim	32.28 KB
foxpro.vim	32.09 KB
framescript.vim	11.41 KB
freebasic.vim	10.58 KB
fstab.vim	15.53 KB
fvwm.vim	24.44 KB
fvwm2m4.vim	711 B
gdb.vim	4.26 KB
gdmo.vim	3.22 KB
gedcom.vim	2.22 KB
gift.vim	10 KB
git.vim	4.2 KB
gitcommit.vim	4.96 KB
gitconfig.vim	1.56 KB
gitolite.vim	4.35 KB
gitrebase.vim	2.88 KB
gitsendemail.vim	580 B
gkrellmrc.vim	4.02 KB
gnash.vim	3.38 KB
gnuplot.vim	23.11 KB
go.vim	7.72 KB
godoc.vim	352 B
gp.vim	2.9 KB
gpg.vim	5.46 KB
gprof.vim	2.07 KB
grads.vim	1.7 KB
gretl.vim	3.64 KB
groff.vim	293 B
groovy.vim	21.96 KB
group.vim	1.68 KB
grub.vim	3.79 KB
gsp.vim	1.98 KB
gtkrc.vim	9.1 KB
haml.vim	6.91 KB
hamster.vim	13.52 KB
haskell.vim	9.03 KB
haste.vim	4.88 KB
hastepreproc.vim	1.39 KB
hb.vim	3.08 KB
help.vim	8.19 KB
help_ru.vim	3.43 KB
hercules.vim	5.59 KB
hex.vim	3.92 KB
hgcommit.vim	1.09 KB
hitest.vim	3.56 KB
hog.vim	11.83 KB
hollywood.vim	43.41 KB
hostconf.vim	3.78 KB
hostsaccess.vim	549 B
html.vim	18.11 KB
htmlcheetah.vim	488 B
htmldjango.vim	1011 B
htmlm4.vim	670 B
htmlos.vim	8.12 KB
ia64.vim	10.23 KB
ibasic.vim	6.87 KB
icemenu.vim	824 B
icon.vim	6.81 KB
idl.vim	19.43 KB
idlang.vim	13.15 KB
indent.vim	7 KB
inform.vim	19.03 KB
initex.vim	18.77 KB
initng.vim	3.32 KB
inittab.vim	2.48 KB
ipfilter.vim	1.58 KB
ishd.vim	26.42 KB
iss.vim	4.91 KB
ist.vim	1.95 KB
j.vim	9.22 KB
jal.vim	8.75 KB
jam.vim	26.08 KB
jargon.vim	740 B
java.vim	18.15 KB
javacc.vim	2.2 KB
javascript.vim	5.48 KB
javascriptreact.vim	133 B
jess.vim	6.08 KB
jgraph.vim	1.18 KB
jovial.vim	4.01 KB
jproperties.vim	5.37 KB
json.vim	6.11 KB
jsp.vim	2.62 KB
kconfig.vim	35.45 KB
kivy.vim	986 B
kix.vim	6.18 KB
kscript.vim	1.94 KB
kwt.vim	2.4 KB
lace.vim	3.98 KB
latte.vim	3.43 KB
ld.vim	2.85 KB
ldapconf.vim	12.99 KB
ldif.vim	1014 B
less.vim	4.1 KB
lex.vim	8.45 KB
lftp.vim	7.3 KB
lhaskell.vim	4.82 KB
libao.vim	636 B
lifelines.vim	6.48 KB
lilo.vim	10.18 KB
limits.vim	1.29 KB
liquid.vim	6.04 KB
lisp.vim	35.05 KB
lite.vim	4.73 KB
litestep.vim	6.52 KB
loginaccess.vim	4.1 KB
logindefs.vim	7.36 KB
logtalk.vim	16.45 KB
lotos.vim	2.31 KB
lout.vim	4.22 KB
lpc.vim	22.6 KB
lprolog.vim	3.89 KB
lscript.vim	11.82 KB
lsl.vim	15.43 KB
lss.vim	4.76 KB
lua.vim	13.72 KB
lynx.vim	6.42 KB
m4.vim	2.63 KB
mail.vim	5.93 KB
mailaliases.vim	2.7 KB
mailcap.vim	1.11 KB
make.vim	6.05 KB
mallard.vim	1.69 KB
man.vim	1.64 KB
manconf.vim	4.24 KB
manual.vim	909 B
maple.vim	27.9 KB
markdown.vim	8.91 KB
masm.vim	16.84 KB
mason.vim	3.73 KB
master.vim	1022 B
matlab.vim	4.21 KB
maxima.vim	18.36 KB
mel.vim	3.33 KB
meson.vim	4.02 KB
messages.vim	2.65 KB
mf.vim	15.06 KB
mgl.vim	3.64 KB
mgp.vim	1.95 KB
mib.vim	2.63 KB
mix.vim	2.87 KB
mma.vim	11.52 KB
mmix.vim	4.85 KB
mmp.vim	1.45 KB
modconf.vim	1.39 KB
model.vim	1.43 KB
modsim3.vim	3.54 KB
modula2.vim	3.15 KB
modula3.vim	1.96 KB
monk.vim	9.98 KB
moo.vim	9.02 KB
mp.vim	43.49 KB
mplayerconf.vim	7.31 KB
mrxvtrc.vim	9.38 KB
msidl.vim	3.38 KB
msmessages.vim	6.17 KB
msql.vim	2.33 KB
mupad.vim	15.11 KB
murphi.vim	4.47 KB
mush.vim	12.88 KB
muttrc.vim	64.27 KB
mysql.vim	17.2 KB
n1ql.vim	12.6 KB
named.vim	9.77 KB
nanorc.vim	10.37 KB
nasm.vim	25.67 KB
nastran.vim	8.3 KB
natural.vim	6.81 KB
ncf.vim	13.1 KB
neomuttrc.vim	64 KB
netrc.vim	1.89 KB
netrw.vim	7.03 KB
ninja.vim	2.82 KB
nosyntax.vim	755 B
nqc.vim	13.74 KB
nroff.vim	7.6 KB
nsis.vim	33.26 KB
obj.vim	2.72 KB
objc.vim	40.79 KB
objcpp.vim	600 B
ocaml.vim	16.56 KB
occam.vim	4.21 KB
omnimark.vim	6.23 KB
opam.vim	1.37 KB
openroad.vim	13.65 KB
opl.vim	4.03 KB
ora.vim	26.5 KB
pamconf.vim	5.81 KB
pamenv.vim	1.11 KB
papp.vim	3.7 KB
pascal.vim	14.66 KB
passwd.vim	2.39 KB
pbtxt.vim	1.34 KB
pcap.vim	1.46 KB
pccts.vim	4 KB
pdf.vim	3.46 KB
perl.vim	37.57 KB
perl6.vim	72.39 KB
pf.vim	10.13 KB
pfmain.vim	90.56 KB
php.vim	95.59 KB
phtml.vim	151 B
pic.vim	3.25 KB
pike.vim	21.3 KB
pilrc.vim	5.19 KB
pine.vim	15.05 KB
pinfo.vim	5.17 KB
plaintex.vim	10.06 KB
pli.vim	12.91 KB
plm.vim	5.24 KB
plp.vim	1.24 KB
plsql.vim	12.62 KB
po.vim	6.24 KB
pod.vim	7.11 KB
poke.vim	5.07 KB
postscr.vim	45.05 KB
pov.vim	8.84 KB
povini.vim	3.41 KB
ppd.vim	868 B
ppwiz.vim	2.71 KB
prescribe.vim	2.33 KB
privoxy.vim	3.5 KB
procmail.vim	1.97 KB
progress.vim	31 KB
prolog.vim	4.39 KB
promela.vim	1.69 KB
proto.vim	3.46 KB
protocols.vim	1.4 KB
psf.vim	4.19 KB
ptcap.vim	4.03 KB
purifylog.vim	3.28 KB
pyrex.vim	1.62 KB
python.vim	12.78 KB
qf.vim	596 B
quake.vim	8.35 KB
r.vim	14.38 KB
racc.vim	5.49 KB
radiance.vim	6.99 KB
raml.vim	4.35 KB
ratpoison.vim	16.82 KB
rc.vim	9.98 KB
rcs.vim	2.08 KB
rcslog.vim	557 B
readline.vim	17.08 KB
rebol.vim	7 KB
redif.vim	85.88 KB
registry.vim	3.28 KB
rego.vim	3.74 KB
remind.vim	2.65 KB
resolv.vim	6.21 KB
reva.vim	7.41 KB
rexx.vim	14.97 KB
rhelp.vim	11.85 KB
rib.vim	2.14 KB
rmd.vim	5.26 KB
rnc.vim	2.21 KB
rng.vim	817 B
rnoweb.vim	1.86 KB
robots.vim	1.49 KB
rpcgen.vim	1.63 KB
rpl.vim	25.1 KB
rrst.vim	1.28 KB
rst.vim	11.5 KB
rtf.vim	2.28 KB
ruby.vim	40.15 KB
rust.vim	16.22 KB
samba.vim	5.99 KB
sas.vim	33.29 KB
sass.vim	6.12 KB
sather.vim	3.41 KB
sbt.vim	880 B
scala.vim	11.04 KB
scheme.vim	18.88 KB
scilab.vim	3.13 KB
screen.vim	8.89 KB
scss.vim	526 B
sd.vim	2.17 KB
sdc.vim	1.36 KB
sdl.vim	6.41 KB
sed.vim	4.92 KB
sendpr.vim	905 B
sensors.vim	1.48 KB
services.vim	1.78 KB
setserial.vim	5.11 KB
sexplib.vim	3.6 KB
sgml.vim	8.66 KB
sgmldecl.vim	1.99 KB
sgmllnx.vim	1.81 KB
sh.vim	43.22 KB
sicad.vim	18.04 KB
sieve.vim	1.63 KB
sil.vim	8.34 KB
simula.vim	3.29 KB
sinda.vim	3.58 KB
sindacmp.vim	1.24 KB
sindaout.vim	1.92 KB
sisu.vim	21.66 KB
skill.vim	25.17 KB
sl.vim	3.99 KB
slang.vim	3.22 KB
slice.vim	2.86 KB
slpconf.vim	11.51 KB
slpreg.vim	5.22 KB
slpspi.vim	1.15 KB
slrnrc.vim	12.51 KB
slrnsc.vim	3.03 KB
sm.vim	2.78 KB
smarty.vim	2.82 KB
smcl.vim	11.76 KB
smil.vim	5.48 KB
smith.vim	793 B
sml.vim	9.29 KB
snnsnet.vim	2.42 KB
snnspat.vim	2.18 KB
snnsres.vim	1.89 KB
snobol4.vim	5.21 KB
spec.vim	12.46 KB
specman.vim	7.17 KB
spice.vim	2.19 KB
splint.vim	15.42 KB
spup.vim	13.6 KB
spyce.vim	4.35 KB
sql.vim	1.09 KB
sqlanywhere.vim	40.95 KB
sqlforms.vim	6.58 KB
sqlhana.vim	10.77 KB
sqlinformix.vim	5.76 KB
sqlj.vim	2.9 KB
sqloracle.vim	7.47 KB
sqr.vim	12.71 KB
squid.vim	6.77 KB
srec.vim	3.73 KB
sshconfig.vim	11.17 KB
sshdconfig.vim	12.62 KB
st.vim	2.69 KB
stata.vim	26.42 KB
stp.vim	5.3 KB
strace.vim	1.92 KB
sudoers.vim	23.88 KB
svg.vim	436 B
svn.vim	1.81 KB
swift.vim	8.62 KB
swiftgyb.vim	822 B
syncolor.vim	4.04 KB
synload.vim	1.99 KB
syntax.vim	1.2 KB
sysctl.vim	1.13 KB
systemd.vim	184 B
systemverilog.vim	3.46 KB
tads.vim	6.7 KB
tags.vim	1.13 KB
tak.vim	2.85 KB
takcmp.vim	1.56 KB
takout.vim	1.95 KB
tap.vim	4.26 KB
tar.vim	373 B
taskdata.vim	1.18 KB
taskedit.vim	1.1 KB
tasm.vim	5.56 KB
tcl.vim	16.88 KB
tcsh.vim	12.96 KB
template.vim	449 B
teraterm.vim	4.86 KB
terminfo.vim	4.69 KB
tex.vim	63.52 KB
texinfo.vim	24.97 KB
texmf.vim	2.23 KB
tf.vim	6.74 KB
tidy.vim	13.24 KB
tilde.vim	1.5 KB
tli.vim	1.62 KB
tmux.vim	5.81 KB
tpp.vim	3.33 KB
trasys.vim	4.92 KB
treetop.vim	3.58 KB
trustees.vim	1.51 KB
tsalt.vim	8.13 KB
tsscl.vim	5 KB
tssgm.vim	2.72 KB
tssop.vim	1.74 KB
tt2.vim	7.74 KB
tt2html.vim	516 B
tt2js.vim	522 B
typescript.vim	1.39 KB
typescriptcommon.vim	131.23 KB
typescriptreact.vim	3.83 KB
uc.vim	6.48 KB
udevconf.vim	1.2 KB
udevperm.vim	2.35 KB
udevrules.vim	6.8 KB
uil.vim	2.75 KB
updatedb.vim	1.19 KB
upstart.vim	3.08 KB
upstreamdat.vim	13.72 KB
upstreaminstalllog.vim	971 B
upstreamlog.vim	2.56 KB
upstreamrpt.vim	13.86 KB
usserverlog.vim	3.04 KB
usw2kagtlog.vim	2.64 KB
valgrind.vim	3.14 KB
vb.vim	19.82 KB
vera.vim	19.09 KB
verilog.vim	4.94 KB
verilogams.vim	5.94 KB
vgrindefs.vim	1.19 KB
vhdl.vim	9.43 KB
vim.vim	73.19 KB
viminfo.vim	1.21 KB
virata.vim	11.34 KB
vmasm.vim	8.31 KB
voscm.vim	6.81 KB
vrml.vim	12.49 KB
vroom.vim	3.41 KB
vsejcl.vim	1004 B
vue.vim	433 B
wast.vim	3.83 KB
wdiff.vim	716 B
web.vim	1.09 KB
webmacro.vim	3.06 KB
wget.vim	3.87 KB
whitespace.vim	357 B
winbatch.vim	11.87 KB
wml.vim	5.6 KB
wsh.vim	1.21 KB
wsml.vim	5.27 KB
wvdial.vim	1.07 KB
xbl.vim	568 B
xdefaults.vim	5.75 KB
xf86conf.vim	14.38 KB
xhtml.vim	186 B
xinetd.vim	13.88 KB
xkb.vim	3.24 KB
xmath.vim	10.58 KB
xml.vim	8.92 KB
xmodmap.vim	45.42 KB
xpm.vim	4.3 KB
xpm2.vim	4.59 KB
xquery.vim	7.02 KB
xs.vim	240.96 KB
xsd.vim	2.08 KB
xslt.vim	2.59 KB
xxd.vim	767 B
yacc.vim	5.52 KB
yaml.vim	12.57 KB
z8a.vim	2.83 KB
zimbu.vim	6.29 KB
zsh.vim	24.58 KB

Edit: hog.vim

" Vim syntax file
" Language: hog (Snort.conf + .rules)
" Maintainer: Victor Roemer, <vroemer@badsec.org>.
" Last Change: 2019 Sep 22
"              2012 Oct 24  -> Originalish release
"              2019 Sep 22  -> included PR 3069

" quit when a syntax file was already loaded
if exists("b:current_syntax")
    finish
endif

setlocal iskeyword-=:
setlocal iskeyword+=-
syn case ignore

" Hog ruletype crap
syn keyword     HogRuleType       ruletype nextgroup=HogRuleTypeName skipwhite
syn match       HogRuleTypeName   "[[:alnum:]_]\+" contained nextgroup=HogRuleTypeBody skipwhite
syn region      HogRuleTypeBody   start="{" end="}" contained contains=HogRuleTypeType,HogOutput fold
syn keyword     HogRuleTypeType   type contained

" Hog Configurables
syn keyword     HogPreproc    preprocessor nextgroup=HogConfigName skipwhite
syn keyword     HogConfig     config nextgroup=HogConfigName skipwhite
syn keyword     HogOutput     output nextgroup=HogConfigName skipwhite
syn match       HogConfigName "[[:alnum:]_-]\+" contained nextgroup=HogConfigOpts skipwhite
syn region      HogConfigOpts start=":" skip="\\.\{-}$\|^\s*#.\{-}$\|^\s*$" end="$" fold keepend contained contains=HogSpecial,HogNumber,HogIPAddr,HogVar,HogComment

" Event filter's and threshold's
syn region      HogEvFilter         start="event_filter\|threshold" skip="\\.\{-}$\|^\s*#.\{-}$\|^\s*$" end="$" fold transparent keepend contains=HogEvFilterKeyword,HogEvFilterOptions,HogComment
syn keyword     HogEvFilterKeyword  skipwhite event_filter threshold
syn keyword     HogEvFilterOptions  skipwhite type nextgroup=HogEvFilterTypes
syn keyword     HogEvFilterTypes    skipwhite limit threshold both contained
syn keyword     HogEvFilterOptions  skipwhite track nextgroup=HogEvFilterTrack
syn keyword     HogEvFilterTrack    skipwhite by_src by_dst contained
syn keyword     HogEvFilterOptions  skipwhite gen_id sig_id count seconds nextgroup=HogNumber

" Suppressions
syn region      HogEvFilter         start="suppress" skip="\\.\{-}$\|^\s*#.\{-}$\|^\s*$" end="$" fold transparent keepend contains=HogSuppressKeyword,HogComment
syn keyword     HogSuppressKeyword  skipwhite suppress
syn keyword     HogSuppressOptions  skipwhite gen_id sig_id nextgroup=HogNumber
syn keyword     HogSuppressOptions  skipwhite track nextgroup=HogEvFilterTrack
syn keyword     HogSuppressOptions  skipwhite ip nextgroup=HogIPAddr

" Attribute table
syn keyword     HogAttribute        attribute_table nextgroup=HogAttributeFile
syn match       HogAttributeFile    contained ".*$" contains=HogVar,HogAttributeType,HogComment
syn keyword     HogAttributeType    filename

" Hog includes
syn keyword     HogInclude    include nextgroup=HogIncludeFile skipwhite
syn match       HogIncludeFile ".*$" contained contains=HogVar,HogComment

" Hog dynamic libraries
syn keyword     HogDylib      dynamicpreprocessor dynamicengine dynamicdetection nextgroup=HogDylibFile skipwhite
syn match       HogDylibFile  "\s.*$" contained contains=HogVar,HogDylibType,HogComment
syn keyword     HogDylibType  directory file contained

" Variable dereferenced with '$'
syn match       HogVar        "\$[[:alnum:]_]\+"

", Variables declared with 'var'
syn keyword     HogVarType    var nextgroup=HogVarSet skipwhite
syn match       HogVarSet     "[[:alnum:]_]\+" display contained nextgroup=HogVarValue skipwhite
syn match       HogVarValue   ".*$" contained contains=HogString,HogNumber,HogVar,HogComment

" Variables declared with 'ipvar'
syn keyword     HogIPVarType  ipvar nextgroup=HogIPVarSet skipwhite
syn match       HogIPVarSet   "[[:alnum:]_]\+" display contained nextgroup=HogIPVarList,HogSpecial skipwhite
syn region      HogIPVarList  start="\[" end="]" contains=HogIPVarList,HogIPAddr,HogVar,HogOpNot

" Variables declared with 'portvar'
syn keyword     HogPortVarType portvar nextgroup=HogPortVarSet skipwhite
syn match       HogPortVarSet "[[:alnum:]_]\+" display contained nextgroup=HogPortVarList,HogPort,HogOpRange,HogOpNot,HogSpecial skipwhite
syn region      HogPortVarList start="\[" end="]" contains=HogPortVarList,HogVar,HogOpNot,HogPort,HogOpRange,HogOpNot
syn match       HogPort       "\<\%(\d\+\|any\)\>" display contains=HogOpRange nextgroup=HogOpRange

" Generic stuff
syn match       HogIPAddr     contained "\<\%(\d\{1,3}$\.\d\{1,3}$\{3}\|any\)\>" nextgroup=HogIPCidr
syn match       HogIPAddr     contained "\<\d\{1,3}$\.\d\{1,3}$\{3}\>" nextgroup=HogIPCidr
syn match       HogIPCidr     contained "\/$[0-2][0-9]\=\|3[0-2]\=$"
syn region      HogHexEsc     contained start='|' end='|' oneline
syn region      HogString     contained start='"' end='"' extend oneline contains=HogHexEsc
syn match       HogNumber     contained display "\<\d\+\>"
syn match       HogNumber     contained display "\<\d\+\>"
syn match       HogNumber     contained display "0x\x\+\>"
syn keyword     HogSpecial    contained true false yes no default all any
syn keyword     HogSpecialAny contained any
syn match       HogOpNot      "!" contained
syn match       HogOpRange    ":" contained

" Rules
syn keyword     HogRuleAction     activate alert drop block dynamic log pass reject sdrop sblock skipwhite nextgroup=HogRuleProto,HogRuleBlock
syn keyword     HogRuleProto      ip tcp tcp-pkt tcp-stream udp icmp http ftp tls smb dns dcerpc ssh smtp imap msn modbus dnp3 enip nfs ikev2 ntp skipwhite contained nextgroup=HogRuleSrcIP
syn match       HogRuleSrcIP      "\S\+" transparent skipwhite contained contains=HogIPVarList,HogIPAddr,HogVar,HogOpNot nextgroup=HogRuleSrcPort
syn match       HogRuleSrcPort    "\S\+" transparent skipwhite contained contains=HogPortVarList,HogVar,HogPort,HogOpRange,HogOpNot nextgroup=HogRuleDir
syn match       HogRuleDir        "->\|<>" skipwhite contained nextgroup=HogRuleDstIP
syn match       HogRuleDstIP      "\S\+" transparent skipwhite contained contains=HogIPVarList,HogIPAddr,HogVar,HogOpNot nextgroup=HogRuleDstPort
syn match       HogRuleDstPort    "\S\+" transparent skipwhite contained contains=HogPortVarList,HogVar,HogPort,HogOpRange,HogOpNot nextgroup=HogRuleBlock
syn region      HogRuleBlock      start="(" end=")" transparent skipwhite contained contains=HogRuleOption,HogComment fold
",HogString,HogComment,HogVar,HogOptNot
"syn region      HogRuleOption     start="\<gid\|sid\|rev\|depth\|offset\|distance\|within\>" end="\ze;" skipwhite contained contains=HogNumber
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP msg gid sid rev classtype priority metadata target content nocase rawbytes
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP depth startswith offset distance within http_client_body http_cookie http_raw_cookie http_header
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP http_raw_header http_request_line http_method http_uri http_raw_uri http_protocol http_response_line http_stat_code http_stat_msg
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP http_user_agent http_accept http_accept_enc http_accept_lang http_connection http_content_type http_content_len
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP http_referer http_start http_header_names http_server_body http_host http_raw_host
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP filename fileext filemagic filestore filemd5 filesha1 filesha256 filesize
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP dns_query tls_cert_subject tls_cert_issuer tls_cert_serial tls_cert_fingerprint
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP tls_sni tls_cert_notbefore tls_cert_notafter tls_cert_expired tls_cert_valid
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP tls.version tls.subject tls.issuerdn tls.fingerprint tls.store ja3_hash ja3_string
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP modbus dnp3_func dnp3_ind dnp3_obj dnp3_data enip_command cip_service
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP app-layer-protocol app-layer-event xbits iprep lua luajit
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP fast_pattern prefilter uricontent urilen isdataat pcre pkt_data file_data base64_decode base64_data
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP byte_test byte_jump byte_extract ftpdata_command ftpbounce asn1 cvs dce_iface dce_opnum dce_stub_data
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP sip_method sip_stat_code sip_header sip_body gtp_type gtp_info gtp_version ssl_version
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP ssl_state fragoffset ttl tos id ipopts geoip fragbits dsize flags flow flowbits flowint seq ack window
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP itype icode icmp_id icmp_seq rpc ip_proto sameip stream_reassemble stream_size
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP logto session resp react tag activates activated_by count replace detection_filter
syn keyword     HogRuleOption   skipwhite contained nextgroup=HogRuleSROP threshold reference sd_pattern file_type file_group

syn region      HogRuleSROP     start=':' end=";" transparent keepend contained contains=HogRuleChars,HogString,HogNumber
syn match       HogRuleChars    "\%(\k\|\.\|?\|=\|/\|%\|&\)\+" contained
syn match       HogURLChars     "\%(\.\|?\|=\)\+" contained

" Hog File Type Rules
syn match       HogFileType   /^\s*file.*$/ transparent contains=HogFileTypeOpt,HogFileFROP
syn keyword     HogFileTypeOpt  skipwhite contained nextgroup=HogRuleFROP file type ver category id rev content offset msg group 
syn region      HogFileFROP  start=':' end=";" transparent keepend contained contains=NotASemicoln
syn match       NotASemiColn   ".*$" contained

" Comments
syn keyword HogTodo   XXX TODO NOTE contained
syn match   HogTodo   "Step\s\+#\=\d\+" contained
syn region HogComment start="#" end="$" contains=HogTodo,@Spell

syn case match

if !exists("hog_minlines")
    let hog_minlines = 100
endif
exec "syn sync minlines=" . hog_minlines

hi link HogRuleType           Statement
hi link HogRuleTypeName       Type
hi link HogRuleTypeType       Keyword

hi link HogPreproc            Statement
hi link HogConfig             Statement
hi link HogOutput             Statement
hi link HogConfigName         Type

"hi link HogEvFilter
hi link HogEvFilterKeyword    Statement
hi link HogSuppressKeyword    Statement
hi link HogEvFilterTypes      Constant
hi link HogEvFilterTrack      Constant

hi link HogAttribute          Statement
hi link HogAttributeFile      String
hi link HogAttributeType      Statement

hi link HogInclude            Statement
hi link HogIncludeFile        String

hi link HogDylib              Statement
hi link HogDylibType          Statement
hi link HogDylibFile          String

" Variables
" var
hi link HogVar                Identifier
hi link HogVarType            Keyword
hi link HogVarSet             Identifier
hi link HogVarValue           String
" ipvar
hi link HogIPVarType          Keyword
hi link HogIPVarSet           Identifier
" portvar
hi link HogPortVarType         Keyword
hi link HogPortVarSet          Identifier
hi link HogPort                Constant

hi link HogTodo               Todo
hi link HogComment            Comment
hi link HogString             String
hi link HogHexEsc             PreProc
hi link HogNumber             Number
hi link HogSpecial            Constant
hi link HogSpecialAny         Constant
hi link HogIPAddr             Constant
hi link HogIPCidr             Constant
hi link HogOpNot              Operator
hi link HogOpRange            Operator

hi link HogRuleAction         Statement
hi link HogRuleProto          Identifier
hi link HogRuleDir            Operator
hi link HogRuleOption         Keyword
hi link HogRuleChars           String

hi link HogFileType    HogRuleAction
hi link HogFileTypeOpt HogRuleOption
hi link NotASemiColn     HogRuleChars

let b:current_syntax = "hog"