[Bro] Supress notices

[Seth Hall]

> On Dec 17, 2014, at 10:23 AM, Kellogg, Brian D (OLN) <bkellogg at dresser-rand.com> wrote:
> 
> Do notice suppressions only suppress that notice type based upon the identifier?  So if the identifier can match across multiple notice types will it suppress those other notice types as well?  Dumb question probably, but just want to verify.

It suppresses based on the combination of the $note field and the $identifier field.  If your notice doesn’t have an $identifier field defined for it, no suppression will occur.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/