[Snort-users] ACID - acknowledgement of events ?

Petr Ruzicka petr_ruzicka at ...131...
Mon Jul 15 16:43:02 EDT 2002


Hi I use Snort + ACID for some time and I would like
to know how you deal with "acknowledged" events. 
Let's say I have couple of events that I have already
saw and I prefer not delete them for future
analysis/comparsion etc. But very soon I have a lot of
such events and I'm becoming lost.
Does ACID have something like "read/unread" events
(mails)? 
Do you archive already seen interesting events and
perform correlations in archive ? 
Thanks 

Petr R.

__________________________________________________
Do You Yahoo!?
Yahoo! Autos - Get free new car price quotes
http://autos.yahoo.com




More information about the Snort-users mailing list