Alerts question

[rangerrkm]

Hello, All

I have a question about the Show PCAP for this event hyperlink, just under the event.

Currently using version 2.3.21, and I do not see the option and/or link. My friend is using version 2.3.10 and has it.

So, just want to make sure that it is not an installation/configuration issue on my side. Since he has the Hyperlink
Show PCAP for this event, just under the event line.

If I select the event line and go to Actions>PCAP, I have the PCAP data and can click on the Download link and get it.

The only thing that we did differently on the installation, was that I selected Suricata and he selected Zeek for the What tool would you like to use to generate metadata?

Thanks for the help,

[jertel]

Hello! 2.3.21 removed the PCAP link from the event expansion area since it was already located in the actions menu, which is accessible by the same number of clicks. This also simplified maintenance of the SOC UI for developers. This explains why your friend's older installation still has it, but yours does not.

[rangerrkm]

Thanks much, jertel.

Really appreciate the information, because I just got everything set up and did not want to rebuild it. If it was an issue with my build process or me switching to Suricata for metadata.