[Bro] Supress notices
seth at icir.org
Thu Dec 18 06:29:38 PST 2014
> On Dec 17, 2014, at 10:23 AM, Kellogg, Brian D (OLN) <bkellogg at dresser-rand.com> wrote:
> Do notice suppressions only suppress that notice type based upon the identifier? So if the identifier can match across multiple notice types will it suppress those other notice types as well? Dumb question probably, but just want to verify.
It suppresses based on the combination of the $note field and the $identifier field. If your notice doesn’t have an $identifier field defined for it, no suppression will occur.
International Computer Science Institute
(Bro) because everyone has a network
More information about the Bro