[Oisf-users] Flowbit question
erich.lerch at gmail.com
Mon Jan 11 21:14:24 UTC 2016
Sometimes it would be helpful if for a given rule which triggered an
alert after evaluating a flowbit, it was possible to know which other
rule was setting this very flowbit.
In ET rulesets, there might be dozens of possible candidates setting a
flowbit, so finding the right candidate is not feasible.
Is there a possiblity to "automagically" find it? Does Suri track this
information internally (so it might be logged somehow)?
More information about the Oisf-users