threshold.config

   1 # Thresholding:
   2 #
   3 # This feature is used to reduce the number of logged alerts for noisy rules.
   4 # Thresholding commands limit the number of times a particular event is logged
   5 # during a specified time interval.
   6 #
   7 # The syntax is the following:
   8 #
   9 # threshold gen_id <gen_id>, sig_id <sig_id>, type <limit|threshold|both>, track <by_src|by_dst>, count <n>, seconds <t>
  10 #
  11 # event_filter gen_id <gen_id>, sig_id <sig_id>, type <limit|threshold|both>, track <by_src|by_dst>, count <n>, seconds <t>
  12 #
  13 # suppress gen_id <gid>, sig_id <sid>
  14 # suppress gen_id <gid>, sig_id <sid>, track <by_src|by_dst>, ip <ip|subnet>
  15 #
  16 # The options are documented at https://suricata.readthedocs.io/en/latest/configuration/global-thresholds.html
  17 #
  18 # Please note that thresholding can also be set inside a signature. The interaction between rule based thresholds
  19 # and global thresholds is documented here:
  20 # https://suricata.readthedocs.io/en/latest/configuration/global-thresholds.html#global-thresholds-vs-rule-thresholds
  21
  22 # Limit to 10 alerts every 10 seconds for each source host
  23 #threshold gen_id 0, sig_id 0, type threshold, track by_src, count 10, seconds 10
  24
  25 # Limit to 1 alert every 10 seconds for signature with sid 2404000
  26 #threshold gen_id 1, sig_id 2404000, type threshold, track by_dst, count 1, seconds 10
  27
  28 # Avoid to alert on f-secure update
  29 # Example taken from https://blog.inliniac.net/2012/03/07/f-secure-av-updates-and-suricata-ips/
  30 #suppress gen_id 1, sig_id 2009557, track by_src, ip 217.110.97.128/25
  31 #suppress gen_id 1, sig_id 2012086, track by_src, ip 217.110.97.128/25
  32 #suppress gen_id 1, sig_id 2003614, track by_src, ip 217.110.97.128/25