ET Prrofpoint flowbit issues (opnsense)

Feedback & Support
1

How do I resolve these issues? The started appearing several weeks ago. The issue related to the OneLouderHeader flowbit issue started occurring within the past 2 weeks.

00|Warning|suricata|[101447] – flowbit ‘ET.OneLouderHeader’ is checked but not set. Checked in 2019103 and 0 other sigs||
|2024-12-09T06:01:02-05:00|Warning|suricata|[101447] – flowbit ‘et.http.PK’ is checked but not set. Checked in 2019835 and 1 other sigs||
|2024-12-09T06:01:02-05:00|Warning|suricata|[101447] – flowbit ‘et.MCOFF’ is checked but not set. Checked in 2019|

2

Greetings! We’re currently working on a process that includes rules that set the flowbits for included rules into the curation process we have on the backend which chooses the rules which are included on ETPRO Telemetry Edition.

3

Hi Rich,

In the meantime I can continue to use the ET telemetry rulesets? I just want confirm that this issue won’t result in an instability in the process.

1 Like
4

You can continue using the ruleset, those warnings you listed do not break the ruleset or the engine.

1 Like
5

Hello, just wanted to provide an update. 2 of the flowbit errors that I have reported have been resolved. The only one remaining is:

2024-12-10T14:01:04-05:00 Warning suricata [101447] – flowbit ‘ET.OneLouderHeader’ is checked but not set. Checked in 2019103 and 0 other sigs

I’m not sure if you pushed an update.