[Snort-users] ACID - acknowledgement of events ?
petr_ruzicka at ...131...
Mon Jul 15 16:43:02 EDT 2002
Hi I use Snort + ACID for some time and I would like
to know how you deal with "acknowledged" events.
Let's say I have couple of events that I have already
saw and I prefer not delete them for future
analysis/comparsion etc. But very soon I have a lot of
such events and I'm becoming lost.
Does ACID have something like "read/unread" events
Do you archive already seen interesting events and
perform correlations in archive ?
Do You Yahoo!?
Yahoo! Autos - Get free new car price quotes
More information about the Snort-users