Bug #5124: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit (5.0.x backport)
alerts: use alert queing in DetectEngineThreadCtx (5.0.x backport)
Currently each alert is written directly to
Packet::alerts during rule evaluation. Then at the end of the detection run for a packet,
PacketAlertFinalize removes entries again, when applying thresholding, suppression and
noalert. This leads to the issue in #4941 but is often also not very efficient esp when there are multiple rules to remove.
The idea of this ticket is to use a per
DetectEngineThreadCtx specific queue of some sort to store the alert "candidates" and have
PacketAlertFinalize only write the final alerts to the Packet structure.