Suppressing Rules

Problem

You want to suppress a rule without permanently removing it from the ruleset.

Solution

Use the suppress command to suppress a rule.

suppress gen_id , sid_id 

 

Discussion

Suppression allows you to deactivate a rule completely. The options are gen_id and sig_id. Gen_id is the generator ID, and sig_id is the Snort signature ID.

To suppress an event entirely:

suppress gen_id 1, sig_id 1234

 

See Also

Snort User Manual

Recipe 3.17

Thresholding Alerts