Open Information Security Foundation

08/07/2019

10:15 PM Suricata Support #3104: eve-nsm log of flow has timestamp much later than flow end

Thanks for the suggestion. Will update when I can apply. Bill Homan

08/04/2019

06:47 PM Suricata Support #3104: eve-nsm log of flow has timestamp much later than flow end

I'm posting a copy of our config.
Bill Homan

06:29 PM Suricata Support #3104: eve-nsm log of flow has timestamp much later than flow end

Thanks for the response! Yes - the flow record is logged hours after flow end. I have other examples where the log ... Bill Homan

08/03/2019

12:50 AM Suricata Support #3104 (Closed): eve-nsm log of flow has timestamp much later than flow end

I'm experimenting with suricata and examining flow logging in eve-nsm.json, and occasionally a flow is logged with a... Bill Homan