[Snort-users] Snort too verbose

Joel Esler jesler at ...1935...
Mon Nov 14 10:35:31 EST 2011


On Nov 14, 2011, at 9:05 AM, Rick Chisholm wrote:

> Since upgrading to 2.9.1.x I find I'm getting much more verbose alerting
> than previously.  Of particular note is http_inspect and ssl_ssp - which I
> think are from certain preprocessors.  What can I do to mute these?

Event_filter.

Look into README.filters in the doc/ directory of the tarball.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire




More information about the Snort-users mailing list