[Bro] Disable some type of "alerts" for internal servers

C.L. Martinez carlopmart at gmail.com
Fri Mar 13 04:46:14 PDT 2015


Hi all,

  I am receiving a lot alerts like this:

  Bro SSL::Invalid_Server_Cert. 172.16.129.8 (Unknown):3040 -> 
172.17.0.130 (Unknown):1610

  which it is correct: we are using a lot of certs auto-signed in our 
infrastructure.

  Is it possible to disable this type of alert for an IP or a group of IP's?

Thanks.


More information about the Bro mailing list