Re: event_filter by IP?

[William Rehnquyst <rehnquyst () gmail com>]

No problem Nick.

By creating two new rules, do you mean to create two almost identical
rules, one 1) that's without alerting limit, but ignores the hosts I want
to limit,  and 2) a second one with alerting limit, and only alerts on the
hosts I want to limit; or some sort of variant?

Thanks for the reply and the good idea!

Rehn


On Tue, Mar 25, 2014 at 2:06 PM, Nicholas Mavis (nmavis)
<nmavis () cisco com>wrote:

>  William,
>
>  Sorry when I responded earlier, I didn't notice you simply wanted to
> limit the number of alerts from this rule on that single IP. I believe your
> only options here are to suppress the rule completely for that IP or create
> two new rules based off the original with a detection filter.
>
>  Nick
>
>   From: William Rehnquyst <rehnquyst () gmail com>
> Date: Monday, March 24, 2014 at 1:24 PM
> To: "snort-users () lists sourceforge net" <snort-users () lists sourceforge net
> >
> Subject: [Snort-users] event_filter by IP?
>
>   Hi,
>
>  We have an alert that is generated quite often on one specific host
> only, and there's isn't anything we can do on the host to remediate this as
> it is a necessary service. It's something we want to keep an eye on but not
> be overwhelmed by.
>
>  Since this is a known issue, we can limit the alert on this host, but we
> don't want to simultaneously limit this alert on other hosts as it can stop
> us from discovering new issues.
>
>  Is there any way I can do the equivalent of event_filter by a specific
> IP? As far as I know event_filter applies to all IPs and I can't specify
> IP. We don't want to completely suppress it. As far as I know pass rule has
> no rate limit.
>
>  Maybe there's some way to rewrite the rule that I don't know of? So far
> the only example of rewriting a rule I've seen is declaring a variable and
> then !$ the var, which again acts as a pass rule.
>
>  Any ideas? Or is my only recourse suppression?
>
> Appreciated,
>  Rehn
------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!