Actions
Feature #4974
openLog references to Eve
Description
Its been discussed a few time of references should be logged to eve. This would give alerts more context without access to the rule. However, logging the rule is also an option.
The reference logged should probably be the fully expanded reference.
Updated by Philippe Antoine over 1 year ago
See https://github.com/OISF/suricata/pull/6677 : Remove unused (for now) references
from signature
Actions