Actions
Bug #7630
openpass rules with alert; keyword log with a verdict of "alert" instead of "pass"
Affected Versions:
Effort:
Difficulty:
Label:
Description
This rule:
pass tls $HOME_NET any -> any any (alert; tls.sni; content:"checkip.amazonaws.com"; sid:202502272;)
produces an alert log entry with a verdict of "alert" instead of "pass":
"verdict": {"action": "alert"},
No data to display
Actions