Actions
Bug #7357
open
EL
EL
filestore keyword option seems not to work
Bug #7357:
filestore keyword option seems not to work
Affected Versions:
Effort:
Difficulty:
Label:
Description
with the same condition described in https://redmine.openinfosecfoundation.org/issues/7356, it seems we have problem with the filestore keyword options:
alert http any any -> any any (msg:"exe"; http.uri; content:"exe"; sid:1; rev:1;)
alert http any any -> any any (msg:"exe"; http.uri; content:"exe"; filestore:both,flow; sid:2; rev:1;)
Signature 1 is alerting and signature 2 is not although we have the option to store all files on the flow. Also extraction is not done.
EL Updated by Eric Leblond over 1 year ago
- Related to Bug #7356: Unexpected effect of filestore keyword added
EL Updated by Eric Leblond over 1 year ago
- Status changed from New to In Progress
- Assignee changed from OISF Dev to Eric Leblond
EL Updated by Eric Leblond over 1 year ago
In https://github.com/OISF/suricata-verify/pull/2111 filestore-v2.11-with-option is testing the problem.
PA Updated by Philippe Antoine over 1 year ago
- Related to Feature #5665: rules: bidirectional transaction matching added
PA Updated by Philippe Antoine 10 months ago
PA Updated by Philippe Antoine 9 months ago
- Status changed from In Progress to Feedback
Discussion about expected behavior in SV PR
Actions