Add a tag to multiple imported pcaps

[sleepingbel]

Version

2.4.80

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

48

RAM

256

Storage for /

250

Storage for /nsm

8 TB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello all,

Is there a method that if we need to import multiple pcaps or evtx files of one case to add a tag so we can identify all these logs.

I know that we have the import.ID, but this id changes with every import.

Regards
Bart

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.