CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

add new pcap annotations

Browse Source
This commit is contained in:
Jason Ertel
2024-03-06 08:19:42 -05:00
parent 12653eec8c
commit 0f12297f50
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/soc/soc_soc.yaml
View File

@@ -127,7 +127,7 @@ soc:
global: True global: True
advanced: True advanced: True
lookupTunnelParent: lookupTunnelParent:
description: When true, if a pivoted event appears to be encapsulated, such as in a VxLan packet, then SOC will pivot to the VxLan packet stream. This can be useful if the PCAP parser is unable to locate the encapsulated packets. However, if the parser is written in a way that it can find a given filter even if its encapsulated, this is best left to false, as the analyst will see the intended packet data rather than the wrapping packet data. description: When true, if a pivoted event appears to be encapsulated, such as in a VXLAN packet, then SOC will pivot to the VXLAN packet stream. When false, SOC will attempt to pivot to the encapsulated packet stream itself, but at the risk that it may be unable to locate it in the stored PCAP data.
global: True global: True
sostatus: sostatus:
refreshIntervalMs: refreshIntervalMs: