Re: threshold.conf global suppression by IP

[Y M <snort () outlook com>]

Yes you can set a global filter among all rule types (text, so, etc). To do this, your event_filter should have:

gen_id 0, sig_id 0

If you want to address text rules only, then

gen_id 1, sig_id 0

and so on.

YM

Sent from Mobile




On Fri, Sep 9, 2016 at 7:16 PM +0300, "Mitch Gates" <MGates () americanbus com<mailto:MGates () americanbus com>> wrote:

Is there any way I can suppress events globally from a dst or src ip rather than defining each individual gen id and 
sig id I want to suppress?

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!