This holds a comma-separated, human-readable list of the specific TCP flags this rule matches against, using the actual flag abbreviations rather than a raw bitmask, active only when cienaCesAclRuleMatchTcpFlags is true. An admin appreciates this string format specifically because it's directly readable during an audit or incident review without needing to decode a bitmask against the TCP flag-bit specification. For example, this field might literally contain the string 'SYN,RST' to match packets carrying both the SYN and RST flags simultaneously -- an unusual and often suspicious combination -- letting an admin immediately understand the rule's intent just by reading the configured value.