Actions
Bug #7357
openfilestore keyword option seems not to work
Affected Versions:
Effort:
Difficulty:
Label:
Description
with the same condition described in https://redmine.openinfosecfoundation.org/issues/7356, it seems we have problem with the filestore keyword options:
alert http any any -> any any (msg:"exe"; http.uri; content:"exe"; sid:1; rev:1;)
alert http any any -> any any (msg:"exe"; http.uri; content:"exe"; filestore:both,flow; sid:2; rev:1;)
Signature 1 is alerting and signature 2 is not although we have the option to store all files on the flow. Also extraction is not done.
Actions