Hello everyone,
I’m looking for a simple and effective way to configure Suricata to retrieve only metadata related to alerts.
Does put the parameter
metadata:yes
in the type alert config lines of the - eve-log: section
can be enough?
Thank you in advance for your help.
