community-id-spec icon indicating copy to clipboard operation
community-id-spec copied to clipboard

Published 20 hours ago • verified publisher icon corelight

Include additional flow properties in ID

Open ckreibich opened this issue 5 years ago • 0 comments

The Community ID could include features beyond the flow tuple, such as the presence of particular file transfers in the flow. This could aid in disambiguation of flows with otherwise colliding IDs, but narrows applicability to monitors that are able to track at this level of inspection.

This is a feature suggestion from SuriCon 2018.

ckreibich avatar Nov 22 '18 03:11 ckreibich