<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">So would there be any way to workaround this by using event_filter or detection_filter? We have several cases on our network where we get lots of false positives for certain rules, but we don’t feel that the rules have no value at all. They just need to be suppressed (or whatever we want to call it) for a certain IP or set of IPs. Thoughts?</div><div class=""><br class=""></div><br class=""><div><blockquote type="cite" class=""><div class="">On Apr 3, 2015, at 11:44 AM, Duane Howard <<a href="mailto:duane.security@gmail.com" class="">duane.security@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Nevermind, just finished reading the threads about the deprecated state, etc. etc.</div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Fri, Apr 3, 2015 at 9:43 AM, Duane Howard <span dir="ltr" class=""><<a href="mailto:duane.security@gmail.com" target="_blank" class="">duane.security@gmail.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="">This seems like a core thing to have broken. Is there no unit test for this?</div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br class=""><div class="gmail_quote">On Tue, Mar 31, 2015 at 6:56 AM, Andreas Herz <span dir="ltr" class=""><<a href="mailto:andi@geekosphere.org" target="_blank" class="">andi@geekosphere.org</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br class="">
<span class=""><br class="">
On 31/03/15 at 08:51, Barkley, Joey wrote:<br class="">
> I am having some trouble getting some rules suppressed in my<br class="">
> threshold.conf file. I have verified the file path in my suricata.yaml<br class="">
> file. I want to basically turn off certain rules for certain IPs. Here<br class="">
> is a sample of what I have in the file:<br class="">
<br class="">
</span>suppress ist not working as intended at the moment, see the issues<br class="">
related to that:<br class="">
<br class="">
<a href="https://redmine.openinfosecfoundation.org/issues/1247" target="_blank" class="">https://redmine.openinfosecfoundation.org/issues/1247</a><br class="">
<br class="">
<a href="https://redmine.openinfosecfoundation.org/issues/1243" target="_blank" class="">https://redmine.openinfosecfoundation.org/issues/1243</a><br class="">
<span class=""><br class="">
<br class="">
> # Suppress Nessus alerts for the nessus server... suppress gen_id 1,<br class="">
> sig_id 2002664, track by_src, ip <IPADDRESS_TO_EXCLUDE> # ET SCAN<br class="">
> Nessus User Agent suppress gen_id 1, sig_id 2102585, track by_src, ip<br class="">
> <IPADDRESS_TO_EXCLUDE> # GPL SCAN nessus 2.x 404 probe suppress gen_id<br class="">
> 1, sig_id 2803236, track by_src, ip <IPADDRESS_TO_EXCLUDE> # ETPRO<br class="">
> SCAN Nessus Scanner UPNP Broadcast<br class="">
><br class="">
> So I have one nessus scanner and I don’t want to log nessus traffic<br class="">
> from it. This is just one example. I have several other false<br class="">
> positives with certain systems but I want to keep the rules available<br class="">
> for logging for everything else.<br class="">
><br class="">
> Am I messing up the syntax? I’ve searched and searched but all I can<br class="">
> find is some references to not being able to override “in rule limits”<br class="">
> and similar wording. Is it possible that this is what is happening<br class="">
> here? I find it hard to believe that I can’t suppress a rule for a<br class="">
> particular IP.<br class="">
><br class="">
> Thanks for the help.<br class="">
><br class="">
> Joey _______________________________________________ Suricata IDS<br class="">
> Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank" class="">oisf-users@openinfosecfoundation.org</a> Site:<br class="">
> <a href="http://suricata-ids.org/" target="_blank" class="">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank" class="">http://suricata-ids.org/support/</a><br class="">
> List:<br class="">
> <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank" class="">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br class="">
> Training now available: <a href="http://suricata-ids.org/training/" target="_blank" class="">http://suricata-ids.org/training/</a><br class="">
<br class="">
</span><span class=""><font color="#888888" class="">--<br class="">
Andreas Herz<br class="">
</font></span><div class=""><div class="">_______________________________________________<br class="">
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank" class="">oisf-users@openinfosecfoundation.org</a><br class="">
Site: <a href="http://suricata-ids.org/" target="_blank" class="">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank" class="">http://suricata-ids.org/support/</a><br class="">
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank" class="">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br class="">
Training now available: <a href="http://suricata-ids.org/training/" target="_blank" class="">http://suricata-ids.org/training/</a></div></div></blockquote></div><br class=""></div>
</div></div></blockquote></div><br class=""></div></div></blockquote></div><br class=""></body></html>