FOR UPLOADED FILES, filescan logs are not tagged with same tags as "source" logs
Steps to reproduce:
- upload
foobar.pcap containing some file transfers
- filter for
tag:foobar (you'll see zeek logs, but not filescan logs)
- remove filter (you'll now see the filescan logs)
For "live" files (captured on Hedgehog, etc.) this should be working correctly. It's only for uploaded ones it's an issue.
FOR UPLOADED FILES, filescan logs are not tagged with same tags as "source" logs
Steps to reproduce:
foobar.pcapcontaining some file transferstag:foobar(you'll seezeeklogs, but notfilescanlogs)For "live" files (captured on Hedgehog, etc.) this should be working correctly. It's only for uploaded ones it's an issue.