[Oisf-users] Question about thresholds

[Michał Purzyński]

A real world example that seems to work here


suppress gen_id 1, sig_id 2002027, track by_dst, ip [
10.22.22.0/24,10.22.11.0/24,2620:1111:1111:1111::/64]

On Tue, Oct 2, 2018 at 1:18 PM Carlos Lopez <clopmz at outlook.com> wrote:

> Hi all,
>
>  Maybe it is a stupid question, but is it not possible to configure a CIDR
> network to supress some alerts via threshold.conf?, for example:
>
> suppress gen_id 1, sig_id 2101201, track by_src, ip 192.168.1.0/24
>
>  If not, what can be the best strategy to accomplish this?
>
> Regards,
> C. L. Martinez
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
> Conference: https://suricon.net
> Trainings: https://suricata-ids.org/training/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20181002/bcd9b9bb/attachment.html>