Actions
Feature #1830
closedsupport 'tag' in eve log
Description
When using the tag keyword special tag records are being written out to unified2. This way more packets than just the one triggering the alert are logged.
Eve should support the same thing. Probably through the 'alert' record with a special sid/gid like in unified2.
Updated by Jason Ish over 8 years ago
Actually unified2 doesn't have the special alert record with the tagged gid/sid anymore. A packet is a discrete record that contains an "event_id" and "event_second" to associate with the alert record previously seen in the unified file.
I thought we could do something similar, a "packet" eve record?
Updated by Jason Ish about 8 years ago
Example packet records:
https://gist.github.com/jasonish/efa5f204ef7e46326d472271d204f107
Updated by Victor Julien about 8 years ago
- Status changed from Assigned to Closed
- Target version changed from 70 to 3.1.2
Actions