<div dir="ltr"><a href="https://redmine.openinfosecfoundation.org/issues/1137">https://redmine.openinfosecfoundation.org/issues/1137</a><br><div>Thanks!</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Thu, Mar 13, 2014 at 9:15 AM, Victor Julien <span dir="ltr"><<a href="mailto:lists@inliniac.net" target="_blank">lists@inliniac.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="">On 03/13/2014 04:48 PM, Duane Howard wrote:<br>
> Rather, is it worth filing a bug or feature request for this?<br>
<br>
</div>Feel free to do so. It will be a low priority issue though.<br>
<br>
Cheers,<br>
Victor<br>
<div class=""><br>
> ./d<br>
><br>
><br>
> On Wed, Mar 12, 2014 at 9:11 AM, Duane Howard <<a href="mailto:duane.security@gmail.com">duane.security@gmail.com</a><br>
</div><div class="">> <mailto:<a href="mailto:duane.security@gmail.com">duane.security@gmail.com</a>>> wrote:<br>
><br>
>     Just curious if there's any plan to support IP lists in<br>
>     threshold.config as Snort does? Or is the plan to continue as is and<br>
>     just create multiple rules?<br>
><br>
>     I'm currently maintaining two different sets of threshold.config<br>
>     files with and without IP lists for Snort/Suricata:<br>
><br>
>     ex:<br>
>     suppress gen_id 1, sig_id 12345, track by_src, ip<br>
>     [10.1.1.1,10.1.2.3,192.168.1.9]<br>
>     vs.<br>
>     suppress gen_id 1, sig_id 12345, track by_src, ip 10.1.1.1<br>
>     suppress gen_id 1, sig_id 12345, track by_src, ip 10.1.2.3<br>
>     suppress gen_id 1, sig_id 12345, track by_src, ip 192.168.1.9<br>
><br>
>     ./d<br>
><br>
><br>
><br>
><br>
</div>> _______________________________________________<br>
> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><br>
><br>
<span class="HOEnZb"><font color="#888888"><br>
<br>
--<br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
<br>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><br>
</font></span></blockquote></div><br></div>