Project

General

Profile

Actions
Copy link

Bug #9170

open
SB SB

detect/iponly: threshold by_flow with a high count never alerts

Bug #9170: detect/iponly: threshold by_flow with a high count never alerts

Added by Shivani Bhardwaj 8 days ago. Updated 5 days ago.

Status:
In Review
Priority:
Normal
Assignee:
Shivani Bhardwaj
Target version:
9.0.0-beta1
Affected Versions:
Effort:
Difficulty:
low
Label:

Description

Since IP Only rules are evaluated once per flow, if a rule contains threshold keyword tracked by flow, then, a high count never gets matched. One count anyway does not need threshold keyword anyway.

Actions
Copy link

Also available in: PDF Atom