[Snort-users] ACID - acknowledgement of events ?

Petr Ruzicka petr_ruzicka at ...131...
Mon Jul 15 16:43:02 EDT 2002

Hi I use Snort + ACID for some time and I would like
to know how you deal with "acknowledged" events. 
Let's say I have couple of events that I have already
saw and I prefer not delete them for future
analysis/comparsion etc. But very soon I have a lot of
such events and I'm becoming lost.
Does ACID have something like "read/unread" events
Do you archive already seen interesting events and
perform correlations in archive ? 

Petr R.

Do You Yahoo!?
Yahoo! Autos - Get free new car price quotes

More information about the Snort-users mailing list