Forum Discussion
irbk
Oct 11, 2023Cirrus
For anyone else that may stumble across this, this is what we ended up using
when CLIENT_ACCEPTED {
if {[TCP::client_port] and [IP::client_addr] !=0} {
persist uie "[IP::client_addr]:[TCP::client_port]"
}
}