Tracking xbits in eve logs

Help
1

I posted this in Discord but putting it here too.

If you have multiple signatures setting xbits and other signatures looking for those xbits to be set, is there a way to track and know which signature is the one that set the bit for the second signature in the eve logs? For instance, in the below example, if there are multiple alerts for SIDs 1111,2222,3333 and 4444, how would you map SID 4444 back to the specific signature that set it?

Ex.
xbits:set,FOO, track by_src, expire 60; sid:1111;
xbits:set,FOO, track by_src, expire 60; sid:2222;
xbits:set,FOO, track by_src, expire 60; sid:3333;

xbits:isset,FOO, track by_src, expire 60; sid:4444;

2

Are those set to noalert or do 1111 etc. trigger? In that case you could check for the flow_id on those and see what signatures in that flow triggered.

3

Yeah I believe you are right for those that are a part of the same flow but for xbits they could end up either in the same flow or different ones. There might be a way to do it in Lua but haven’t had a lot of time to dig into that direction.