Actions
Bug #7630
openpass rules with alert; keyword log with a verdict of "alert" instead of "pass"
Affected Versions:
Effort:
Difficulty:
Label:
Description
This rule:
pass tls $HOME_NET any -> any any (alert; tls.sni; content:"checkip.amazonaws.com"; sid:202502272;)
produces an alert log entry with a verdict of "alert" instead of "pass":
"verdict": {"action": "alert"},
Updated by Philippe Antoine 4 days ago
- Status changed from New to Feedback
- Assignee changed from OISF Dev to Juliana Fajardini Reichow
Hmmm... I would expect a verdict alert...
Actions