Actions
Bug #6633
closedstats: flows with a detection-only alproto not accounted in this protocol
Affected Versions:
Effort:
Difficulty:
Label:
Actions
Added by Philippe Antoine almost 2 years ago. Updated almost 2 years ago.
jq 'select(.event_type=="flow" and .app_proto=="enip") | .app_proto' log/eve.json | wc -l gives 1 ENIP detection-only flow
Butjq 'select(.event_type=="stats") | .stats."app_layer".flow.enip' log/eve.json gives 0