2026-10-15 14:27 UTC
@FritzAdalis@infosec.exchange I'm not sure. The only place I currently use it is on WAFs but that's because it's the only place I have visibility and that supports / logs it. That's part of my question too, I guess. I don't know how else to observe it on corp networks.
Replies (1)
-
@badsamurai@infosec.exchange 2026-10-15 14:39
@cR0w@infosec.exchange @FritzAdalis@infosec.exchange Zeek & Corelight shops would have access to it. But that’s more D&R where WAF implements them as protect policies (Akamai, Shape/F5, Cloudflare, AWS, etc)