Snort Priority Blocking

Atlantisman

Hello,

I was wondering if there was a way in snort to only block Priority 1 alerts and just ignore 2 and 3 when it comes to blocking?

Thanks.

BBcan177

I don't think so, you should disable rules or use suppression's for that. I haven't tried, but you might be able to use a "pass" rule in the custom.rules tab.

Are there particular Alerts that are causing you trouble?

bmeeks

@Atlantisman:

Hello,

I was wondering if there was a way in snort to only block Priority 1 alerts and just ignore 2 and 3 when it comes to blocking?

Thanks.

No, for Snort "any alert = block" if block offenders is enabled. It does not look at priority.

Bill

Atlantisman

Thanks for your assistance bmeeks!