Project

General

Profile

Actions
Copy link

Bug #9170

closed
SB SB

detect/iponly: threshold by_flow with a high count never alerts

Bug #9170: detect/iponly: threshold by_flow with a high count never alerts

Added by Shivani Bhardwaj 28 days ago. Updated 15 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Shivani Bhardwaj
Target version:
9.0.0-beta1
Affected Versions:
Effort:
Difficulty:
low
Label:

Description

Since IP Only rules are evaluated once per flow, if a rule contains threshold keyword tracked by flow, then, a high count never gets matched. One count anyway does not need threshold keyword anyway.

Related issues 1 (1 open — 0 closed)

Copied to Suricata - Task #9239: detect/iponly: threshold by_flow with a high count never alerts (follow-up)AssignedShivani BhardwajActions

SB Updated by Shivani Bhardwaj 25 days ago Actions
Copy link
 #1

  • Status changed from Assigned to In Review

SB Updated by Shivani Bhardwaj 25 days ago Actions
Copy link
 #2

  • Difficulty set to low

JI Updated by Jason Ish 15 days ago Actions
Copy link
 #3

  • Copied to Task #9239: detect/iponly: threshold by_flow with a high count never alerts (follow-up) added

JI Updated by Jason Ish 15 days ago ยท Edited Actions
Copy link
 #4

  • Status changed from In Review to Closed

Merged, follow-up task created.

Actions
Copy link

Also available in: PDF Atom