Is there a way to control where the payload/payload_printable begins for an alert in eve.json?
Is the payload/payload_printable supposed to begin at the start of the TCP stream?
I thought that was the case but I recently ran into a situation where the payload_printable in eve.json began at packet 83 of a 166 packet session and DID NOT include the content that triggered the alert.
More generally, I’m asking because I want the payload to include the content that triggers an alert. This has proven difficult for large SMTP sessions like the one mentioned above (131k in this case).