Actually it’s the same as in Suricata protocol DCERPC cannot trigger alert when adding new rule - #3 by vjulien and the fix from Victor is working, I was able to check the working fix with your example here.
1 Like