corelight / corelight/CVE-2022-24497
btest fails with Zeek v8.0.0 due to conn.log ip_proto
Open
- Dominant language
- Shell
- Stars
- 3
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
conn.log includes ip_proto and the test baseline doesn't account for it
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by running btest for the CVE-2022-24497 Zeek detector with Zeek v8.0.0 and inspect the conn.log test baseline. Compare the generated conn.log output with the expected baseline, then account for the ip_proto field so the test passes with that Zeek version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- shell
- Domain
- testing
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100