[Oisf-users] Fwd: Stream field in Alert Record in eve.json

[Victor Julien]

On 17-07-18 19:17, Michael Riggs wrote:
> 
> Hey list,
> 
> I've dug around, but I cannot see the how/why the stream field is set
> "stream":0
> "stream":1
> 
> Is there documentation around the fields or can someone drop me how this
> is determined?

If set to 1 (true) it means the payload field is constructed from stored
stream segments. If it is 0 (false), it's the packet payload.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------