[Oisf-users] Relating packets to alerts

Luis Escamilla luis at cyberopsec.com.mx
Thu Mar 28 17:57:59 UTC 2019

I would like to create a pcap file of the flow that fired the alert from the tagged packets, but I'm having trouble identifying which packets correspond to a certain alert

´╗┐On 3/28/19, 7:34 AM, "jt" <jtfas90 at gmail.com> wrote:

    Are you looking for the specific packet number in a given flow that
    fired an alert(s)?
    On Wed, 2019-03-27 at 20:27 +0000, Luis Escamilla wrote:
    > Is it possible to identify in an eve log which of the tagged packets
    > correspond to certain alert? I have been doing it by flow id, but
    > many times, the flow id is related to multiple alerts
    > _______________________________________________
    > Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
    > Site: http://suricata-ids.org | Support: 
    > http://suricata-ids.org/support/
    > List: 
    > https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
    > Conference: https://suricon.net
    > Trainings: https://suricata-ids.org/training/

More information about the Oisf-users mailing list