[Oisf-users] Logging Full Rule When Event Occurs

[John Peters]

Had an interesting question come up during a recent conversation:  Is it
possible to have the full rule written to eve.json with the corresponding
event when it triggers?  The reasoning is it would be easier to see the
actual rule when searched for in a log aggregator than have to sift through
what's active in /rules.  If it an option or possible, what's the best
route to get it to happen?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20180206/6851c9c6/attachment.html>