Snorby....No alerts on certain Events

[archan...@gmail.com]

Can you configure Snorby not to alert on certain events? For instance we use Google talk in our environment and want Snorby not to alert on those events. I have looked in the Admin tab and tried mass Classifications with no avail. The actual event signature is GPL CHAT MISC Jabber/Google Talk Outgoing Traffic.

[Jeremy Hoel]

Your best option if the rule fires on traffic you don't want to alert on, as in you use it and it's ok, then disable the rule.  there is no way to not alert on rules in Snorby

On Wed, Jun 25, 2014 at 5:16 PM, <archan...@gmail.com> wrote:

Can you configure Snorby not to alert on certain events? For instance we use Google talk in our environment and want Snorby not to alert on those events. I have looked in the Admin tab and tried mass Classifications with no avail. The actual event signature is GPL CHAT MISC Jabber/Google Talk Outgoing Traffic.

--
You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
To post to this group, send email to securit...@googlegroups.com.
Visit this group at http://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.

[archan...@gmail.com]

Jimmy- Can you point me in the direction to disable the rules?

[Doug Burks]

https://code.google.com/p/security-onion/wiki/ManagingAlerts#Disable_the_sid

On Wed, Jun 25, 2014 at 1:55 PM, <archan...@gmail.com> wrote:
> Jimmy- Can you point me in the direction to disable the rules?
>

> --
> You received this message because you are subscribed to the Google Groups "security-onion" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
> To post to this group, send email to securit...@googlegroups.com.
> Visit this group at http://groups.google.com/group/security-onion.
> For more options, visit https://groups.google.com/d/optout.

--
Doug Burks