[Oisf-users] signature action drop instead of alert

[Andreas Herz]

On 23/01/20 at 00:15, Vieri wrote:
> I'm using Suricata 5.0.1, and I'm getting lots of "drops" for several SURICATA STREAM signatures.

In general you don't want to convert those rules to drop as they will
trigger quite often at mixed traffic environments in some cases.

> # grep -r 2210042 /var/lib/suricata/*
> /var/lib/suricata/rules/suricata.rules:alert tcp any any -> any any (msg:"SURICATA STREAM TIMEWAIT ACK with wrong seq"; stream-event:timewait_ack_wrong_seq; classtype:protocol-command-decode; sid:2210042; rev:2;)
> 
> If this signature has the "alert" action set in the rules file, why is EVE logging it as a "drop"?

Can you check what path is set in the suricata config?
I would guess that it's using another ruleset where you have action drop
instead of alert.

-- 
Andreas Herz