From 2b4e10224eaebb613352e9b82556b60035d032a1 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Wed, 13 Mar 2024 21:26:05 +0100 Subject: [PATCH] output/alert: check flag before logging app-layer Ticket: 6846 --- src/output-json-alert.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/src/output-json-alert.c b/src/output-json-alert.c index eb88af294a..99ffbc251d 100644 --- a/src/output-json-alert.c +++ b/src/output-json-alert.c @@ -627,12 +627,14 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p) } if (p->flow != NULL) { - if (json_output_ctx->flags & LOG_JSON_APP_LAYER) { - AlertAddAppLayer(p, jb, pa->tx_id, json_output_ctx->flags); - } - /* including fileinfo data is configured by the metadata setting */ - if (json_output_ctx->flags & LOG_JSON_RULE_METADATA) { - AlertAddFiles(p, jb, pa->tx_id); + if (pa->flags & PACKET_ALERT_FLAG_TX) { + if (json_output_ctx->flags & LOG_JSON_APP_LAYER) { + AlertAddAppLayer(p, jb, pa->tx_id, json_output_ctx->flags); + } + /* including fileinfo data is configured by the metadata setting */ + if (json_output_ctx->flags & LOG_JSON_RULE_METADATA) { + AlertAddFiles(p, jb, pa->tx_id); + } } EveAddAppProto(p->flow, jb); -- 2.47.2