Feature #7391
opendetect/config: 'scope' can't be applied to 'flow'
Description
Although the documentation already states this (see https://docs.suricata.io/en/latest/rules/config.html#keyword), from the code,
it seems that this should be allowed.
There are also optimization requests that would require this option to exist (cf.: #5643 )
JF Updated by Juliana Fajardini Reichow almost 2 years ago
- Related to Optimization #5643: pcap: rule based conditional pcap logging added
- Related to Bug #6663: Config rules does not disable logging. added
PA Updated by Philippe Antoine about 1 year ago
This is not a bug, just a feature for support of scope flow. am I getting it right ?
PA Updated by Philippe Antoine about 1 year ago
- Status changed from New to Feedback
PA Updated by Philippe Antoine about 1 month ago
- Tracker changed from Bug to Feature
JF Updated by Juliana Fajardini Reichow 15 days ago
Philippe Antoine wrote in #note-2:
This is not a bug, just a feature for support of
scope flow. am I getting it right ?
To me, it's either a bug, or the doc needs improvement. Because from the documentation, I if I see that the `type` can be `flow`,
I expect that a `scope` should be possibly applied to a flow.
(To be honest, the doc is confusing to me and I think we would benefit from examples there, to clarify them)