Actions
Optimization #5180
opendetect/alert: make sure that signatures with `drop` action are respected, even if the alert is discarded
Effort:
Difficulty:
Label:
Description
Considering that an alert could be discarded from the packet queue due to queue size limitations, we must consider how signatures with the `drop` action are still taken into account, even if the respective alert is dropped.
I guess... thought must also be given with regards to how do we indicate what is going on with said traffic, even if the alert isn't kept. Debug log? Specific stats counter?
Updated by Juliana Fajardini Reichow over 2 years ago
- Related to Optimization #5178: detect/alert: improve packet alert queue handling added
Updated by Juliana Fajardini Reichow over 2 years ago
- Subject changed from detect/alert: make sure that signature with `drop` action are respected, even if the alert is discarded to detect/alert: make sure that signatures with `drop` action are respected, even if the alert is discarded
Updated by Juliana Fajardini Reichow over 2 years ago
- Status changed from New to In Progress
Updated by Juliana Fajardini Reichow over 2 years ago
- Status changed from In Progress to Assigned
Will stop current work on this issue because we will try to follow the approach for #4943.
Updated by Juliana Fajardini Reichow over 2 years ago
- Target version changed from TBD to 7.0.0-beta1
Updated by Juliana Fajardini Reichow over 2 years ago
- Status changed from Assigned to In Progress
Updated by Juliana Fajardini Reichow over 2 years ago
Back to working on this.
Draft PR for appreciation and improvements: https://github.com/OISF/suricata/pull/7469
Updated by Victor Julien almost 2 years ago
- Target version changed from 7.0.0-beta1 to 7.0.0-rc1
Updated by Juliana Fajardini Reichow over 1 year ago
- Tracker changed from Task to Optimization
Updated by Juliana Fajardini Reichow over 1 year ago
- Target version changed from 7.0.0-rc1 to 7.0.0-rc2
Updated by Juliana Fajardini Reichow over 1 year ago
- Target version changed from 7.0.0-rc2 to 8.0.0-beta1
Actions