For statically configured sensor setups, it makes sense to have slinkwatch running as a notification-only tool that only logs active set state changes instead of modifying the interface configuration and restarting Suricata. Operations engineers could then use this information to investigate loss of visibility events individually.
For statically configured sensor setups, it makes sense to have slinkwatch running as a notification-only tool that only logs active set state changes instead of modifying the interface configuration and restarting Suricata. Operations engineers could then use this information to investigate loss of visibility events individually.