Whitelist certain hits in prelude-lml
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <OFE06ABB60.4C86DCAE-ON0A257535.0072F759-0A257535.007303C7@thdfsg.com> |
I have a custom rule that I'm trying to write for prelude-lml. I have the regex working, but there is a particular false-positive that I'd like to screen out. How would I set things up so that there wouldn't be a trigger if the target IP is 10.0.0.5? How about if part of the regex matches a certain string? (IE, skip if $4 = "False Alarm") Dean Takemori Tech Support Supervisor TD Food Group [email protected] _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user