[Snort-sigs] Disable a rule when another trigger
nkrukauskas at ...2420...
Thu Jul 15 04:56:13 EDT 2010
On Thu, July 15, 2010 11:18, Flavian Dola wrote:
> Is there a way to tell snort to disable a specific rule when another
> rule match a packet?
> In fact, I have two rules that generate two different alerts on one frame.
> Ideally, I would like to have just only one alert. And I don't want to
> disable permanently one of these rules.
I guess, flowbits option is the answer.
More information about the Snort-sigs