Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

output/eve: add 'verdict' field to 'alert' and 'drop' events - v1 #8318

Closed
wants to merge 3 commits into from
Closed

output/eve: add 'verdict' field to 'alert' and 'drop' events - v1 #8318

wants to merge 3 commits into from

Commits on Dec 23, 2022

  1. output/eve: add verdict field w final packet action 

    The eve logs have a field alert.action that will say something like
'allowed' even if a packet gets blocked by some other rule. To make
this less ambiguous, added a field to the alert and drop events
indicating the final verdict by the engine for a given packet.

Bug OISF#5464
    @jufajardini
    jufajardini committed Dec 23, 2022
    Configuration menu
    Copy the full SHA
    3d347d6 View commit details
    Browse the repository at this point in the history

  2. userguide/eve: format and reorganize alert section 

    The `fiel action` portion seemed to be comprised of a more generic
section that followed it. Also formatted the section for lines to be
within the character limit.
    @jufajardini
    jufajardini committed Dec 23, 2022
    Configuration menu
    Copy the full SHA
    1f942d5 View commit details
    Browse the repository at this point in the history

  3. userguide/eve: add section about drop event type

    @jufajardini
    jufajardini committed Dec 23, 2022
    Configuration menu
    Copy the full SHA
    4cc59a8 View commit details
    Browse the repository at this point in the history