Is the referrer in the http header? I am trying to ignore events where the referrer or host is accounts.google.com. Thanks! -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170404/c9db6000/attachment.html>