[Snort-users] Event_filters don't work with in-rule threshold filters.

wkitty42 at ...14940... wkitty42 at ...14940...
Mon Apr 25 22:14:54 EDT 2016


On 04/25/2016 04:03 PM, Y M wrote:
>
> Or you can use the modifysid.conf to completely remove the event_filter or
> modify its value per-rule to the desired value.

that's what i was aiming for with my pointer to modifysid ;)

-- 
  NOTE: No off-list assistance is given without prior approval.
        *Please keep mailing list traffic on the list* unless
        private contact is specifically requested and granted.




More information about the Snort-users mailing list