Project

General

Profile

Actions
Copy link

Feature #4179

open

tunnel-Node for flow, netflow and dns-events in eve.json

Added by marco sen over 3 years ago.

Status:
New
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:

Description

For suricata alert-events in eve.json there is a tunnel-node, that contains the outer ip-addresses. It would be great to get this node for flow-, netflow- and dns-events as well. This would make it possible to clearly identify the flow and compare/merge it with results of other tools.

No data to display

Actions
Copy link

Also available in: Atom PDF