[Bro] Supress notices

Seth Hall seth at icir.org
Thu Dec 18 06:29:38 PST 2014

> On Dec 17, 2014, at 10:23 AM, Kellogg, Brian D (OLN) <bkellogg at dresser-rand.com> wrote:
> Do notice suppressions only suppress that notice type based upon the identifier?  So if the identifier can match across multiple notice types will it suppress those other notice types as well?  Dumb question probably, but just want to verify.

It suppresses based on the combination of the $note field and the $identifier field.  If your notice doesn’t have an $identifier field defined for it, no suppression will occur.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list