[Snort-users] Signature question...

Jeff Kell jeff-kell at ...6282...
Tue Jan 20 17:36:00 EST 2004


I've checked the FAQ and other sources but the volume of information is 
overwhelming, so let me ask a possibly silly question...

I am in the process of "tuning" our signatures to rule out false 
positives (e.g., FrontPage alerts on fully-patched machines).  I do not 
want to disable the signature completely (although I do know how to do 
that), but merely "pass" on the check if it is one of our known patched 
servers.

Thanks in advance,

Jeff





More information about the Snort-users mailing list