[Snort-users] Signature question...
jeff-kell at ...6282...
Tue Jan 20 17:36:00 EST 2004
I've checked the FAQ and other sources but the volume of information is
overwhelming, so let me ask a possibly silly question...
I am in the process of "tuning" our signatures to rule out false
positives (e.g., FrontPage alerts on fully-patched machines). I do not
want to disable the signature completely (although I do know how to do
that), but merely "pass" on the check if it is one of our known patched
Thanks in advance,
More information about the Snort-users