Snort Priority Blocking

[Atlantisman]

Hello,

I was wondering if there was a way in snort to only block Priority 1 alerts and just ignore 2 and 3 when it comes to blocking?

Thanks.

[BBcan177]

I don't think so, you should disable rules or use suppression's for that. I haven't tried, but you might be able to use a "pass" rule in the custom.rules tab.

Are there particular Alerts that are causing you trouble?

[bmeeks]

@Atlantisman:

Hello,

I was wondering if there was a way in snort to only block Priority 1 alerts and just ignore 2 and 3 when it comes to blocking?

Thanks.

No, for Snort "any alert = block" if block offenders is enabled.  It does not look at priority.

Bill

[Atlantisman]

Thanks for your assistance bmeeks!