Flowbit issues (proofpoint)

Rules
1

How do I resolve theses issues? They just started appearing. Do they impact the stability of Suricata? These are Proofpoint rules.

|00|Warning|suricata|[101447] – flowbit ‘ET.OneLouderHeader’ is checked but not set. Checked in 2019103 and 0 other sigs||
|2024-12-09T06:01:02-05:00|Warning|suricata|[101447] – flowbit ‘et.http.PK’ is checked but not set. Checked in 2019835 and 1 other sigs||
|2024-12-09T06:01:02-05:00|Warning|suricata|[101447] – flowbit ‘et.MCOFF’ is checked but not set. Checked in 2019|

2

You may close this thread. I posted a message on the emerging threat support forum.

1 Like
4

The usual cause for this is when the ET ruleset has been modified and the rule(s) setting the flow bit have been removed inadvertently.

Flowbits create state and the state can be checked by multiple rules.