From a07a0c35fdfe15121aa7d57a52f8f7bd02a08492 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Wed, 13 Mar 2024 21:26:05 +0100 Subject: [PATCH] output/alert: check flag before logging app-layer Ticket: 6846 (cherry picked from commit 2b4e10224eaebb613352e9b82556b60035d032a1) --- src/output-json-alert.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/src/output-json-alert.c b/src/output-json-alert.c index a7df106550..1ce4366e89 100644 --- a/src/output-json-alert.c +++ b/src/output-json-alert.c @@ -782,12 +782,14 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p) } if (p->flow != NULL) { - if (json_output_ctx->flags & LOG_JSON_APP_LAYER) { - AlertAddAppLayer(p, jb, pa->tx_id, json_output_ctx->flags); - } - /* including fileinfo data is configured by the metadata setting */ - if (json_output_ctx->flags & LOG_JSON_RULE_METADATA) { - AlertAddFiles(p, jb, pa->tx_id); + if (pa->flags & PACKET_ALERT_FLAG_TX) { + if (json_output_ctx->flags & LOG_JSON_APP_LAYER) { + AlertAddAppLayer(p, jb, pa->tx_id, json_output_ctx->flags); + } + /* including fileinfo data is configured by the metadata setting */ + if (json_output_ctx->flags & LOG_JSON_RULE_METADATA) { + AlertAddFiles(p, jb, pa->tx_id); + } } EveAddAppProto(p->flow, jb); -- 2.47.2