{"action":"created","issue":{"url":"https://api.github.com/repos/snortadmin/snort3/issues/11","repository_url":"https://api.github.com/repos/snortadmin/snort3","labels_url":"https://api.github.com/repos/snortadmin/snort3/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/snortadmin/snort3/issues/11/comments","events_url":"https://api.github.com/repos/snortadmin/snort3/issues/11/events","html_url":"https://github.com/snortadmin/snort3/issues/11","id":186857631,"number":11,"title":"snort failed to verdict reset with small file.","user":{"login":"freedai","id":19272387,"avatar_url":"https://avatars.githubusercontent.com/u/19272387?v=3","gravatar_id":"","url":"https://api.github.com/users/freedai","html_url":"https://github.com/freedai","followers_url":"https://api.github.com/users/freedai/followers","following_url":"https://api.github.com/users/freedai/following{/other_user}","gists_url":"https://api.github.com/users/freedai/gists{/gist_id}","starred_url":"https://api.github.com/users/freedai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/freedai/subscriptions","organizations_url":"https://api.github.com/users/freedai/orgs","repos_url":"https://api.github.com/users/freedai/repos","events_url":"https://api.github.com/users/freedai/events{/privacy}","received_events_url":"https://api.github.com/users/freedai/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-11-02T16:52:36Z","updated_at":"2016-11-22T11:59:00Z","closed_at":null,"body":"Snort-3.0.0-a4-213.\r\nWhen I set reset for EICAR.COM, I can download that file and I didn't see signature_lookup got triggered. The file is very small and just 69 bytes. reset avast_free_antivirus_setup_online.ext works fine.\r\n\r\n```\r\nfile_id =\r\n{\r\n    enable_type = true,\r\n    enable_signature = true,\r\n    file_rules = file_magic,\r\n    enable_capture = true,\r\n    type_depth = 104857600,\r\n    signature_depth = 104857600,\r\n    capture_max_size = 104857600,\r\n    trace_type = true,\r\n    trace_signature = true,\r\n    file_policy =\r\n    {\r\n        -- http://10.50.8.202/pkgs/virus/avast_free_antivirus_setup_online.exe\r\n        { when = {sha256 = \"7ea883d91f36d26166751e05d734571a561312fbd078068787ad3efac2bcb0e6\"}, use = {verdict = 'reset' } },\r\n        -- http://10.50.8.202/pkgs/virus/EICAR.COM\r\n        { when = {sha256 = \"131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267\"}, use = {verdict = 'reset' } }\r\n    },\r\n}\r\n```"},"comment":{"url":"https://api.github.com/repos/snortadmin/snort3/issues/comments/262223047","html_url":"https://github.com/snortadmin/snort3/issues/11#issuecomment-262223047","issue_url":"https://api.github.com/repos/snortadmin/snort3/issues/11","id":262223047,"user":{"login":"snortadmin","id":10155553,"avatar_url":"https://avatars.githubusercontent.com/u/10155553?v=3","gravatar_id":"","url":"https://api.github.com/users/snortadmin","html_url":"https://github.com/snortadmin","followers_url":"https://api.github.com/users/snortadmin/followers","following_url":"https://api.github.com/users/snortadmin/following{/other_user}","gists_url":"https://api.github.com/users/snortadmin/gists{/gist_id}","starred_url":"https://api.github.com/users/snortadmin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snortadmin/subscriptions","organizations_url":"https://api.github.com/users/snortadmin/orgs","repos_url":"https://api.github.com/users/snortadmin/repos","events_url":"https://api.github.com/users/snortadmin/events{/privacy}","received_events_url":"https://api.github.com/users/snortadmin/received_events","type":"User","site_admin":false},"created_at":"2016-11-22T11:59:00Z","updated_at":"2016-11-22T11:59:00Z","body":"@huicao - will this be fixed in Alpha 4?"}}
{"actor":{"display_login":"snortadmin"}}