Re: suppress message with idmef-criteria-filter
ScottO <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Ah, I thought you *didn't* want to suppress them from the database. I think the best way is to tune them out at the sensor, but if you want to do so manager-side, utilize the idmef-criteria with a hook to the db plugin, something like: [idmef-criteria=mytestinstance] rule = alert.classification.text != 'Some text you are matching on in the classification.text field' hook = db Scott On Thu, Nov 13, 2008 at 7:01 AM, Varejante Solphins <[email protected]>wrote: > Hello ScottO, > > Thanks for your answer. > > It is not exactly what I want. I have several managers who access the > application. I want to avoid that unwanted messages are stored in the > database and not only from event view. > > > -- > > > _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user