disabling payloads for snort alerts
Robert Vineyard <[email protected]> Wed, 09 Dec 2009 16:51:55 -0500
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Is there any way to configure Prelude to not output the payloads for packets that Snort alerts on? I'm trying to get the volume of data going into my database down and that seems like an obvious place to cut, but I can't seem to find an option for that anywhere. I've turned off all of the snort options that I've found for saving / dumping payloads but Prelude still wants to capture them and load them into the database. Thanks! -- [ Robert Vineyard | RHCE, Security+ ] [ [email protected] ] [ Information Security Engineer III ] [ 404.385.6900 | FAX 404.894.4690 ] [Finding a needle in a haystack isn't hard when every straw is computerized] _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user