Help with Suppression
Thanos Constantopoulos via Snort-devel <[email protected]> Fri, 8 Feb 2019 12:04:13 +0200
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <CA+q=bgyR6Mw-KszVVATBYpOxBOLF7Ye4xa6i3xV1A4Q_CfGeow@mail.gmail.com> |
Hello All,
We are running Snort3.0.0-250 as IDS and we are trying to suppress
several IP addresses from the logs (global suppression from all
signatures). In order to perform this for specific IP addresses by
source we add the below under snort.lua
suppress =
{
{ gid = 119, sid = 228 },
{ gid = 119, sid 225 },
{ gid = 0, sid =0, track = by_src, ip = '10.10.10.10', ip = '192.168.10.10' },
}
My questions are:
- Is there a way to use additional suppresion rules to cover by_src
with the same gid and sid?
- Is there a way to use additional suppresion rules to cover by_src
and by_dst, to totally exluded a subnet or IP address?
_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel
Please visit http://blog.snort.org for the latest news about Snort!