Suricata

At least in IPS mode, a reject is a drop + reject. Since the reject is a best effort thing, the drop is what we think of as the most important action. Any thoughts on how to express it differently to help your use case?

This one was reported to me by an internal user but I think the motivations are both philosophical and practical.

On the philosophical side I think many of our users don't necessarily think about the internal mechanics of a reject being composed of a drop plus a best-effort reset - they think more in terms of actions that are configured in rules, where their problem here is answering something like "how many times were the configured pass/drop/alert/reject actions applied". The practical side of the request is around answering that question using common log analysis tools, where counting the number of actions using the event.verdict.action field is easy but interpreting the context around it to differentiate a drop from a drop+reset (a "reject") is much harder.

Introducing something like a rule-action field that would report consistently with the rule action might be a solution that would make the most sense for these users, or alternatively allowing action to be a list (of ["drop", "reset"]) might work although it would be a bit more cumbersome for both understanding and analysis.

Philippe Antoine wrote in #note-3:

Juliana, you are working on this verdict stuff, right ?

Yep, initially, at least :)

I think at the moment it's on us to decide whether the idea of having an action list would make sense, or the alternative of adding `reject` as a possible `action.