Suricata

Bug #4881

Updated by Victor Julien almost 3 years ago

When an alert is using filestore, the stored files are not marked as such: 
 <pre> 
    

 @    "files": [ 
     { 
       "sid": [ 
         3 
       ], 
       "tx_id": 0, 
       "gaps": false, 
       "size": 1188, 
       "state": "UNKNOWN", 
       "filename": "/~lds/b.apkg", 
       "stored": false 
     } 
   ], 
 </pre> @

Back