From 97107a18c1665e925841d1c9868ff689574d028c Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 29 Mar 2018 15:31:47 +0200 Subject: [PATCH] doc: add by_either to suppress explanation --- doc/userguide/configuration/global-thresholds.rst | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/doc/userguide/configuration/global-thresholds.rst b/doc/userguide/configuration/global-thresholds.rst index adb5cb8b47..2ec4cbfb03 100644 --- a/doc/userguide/configuration/global-thresholds.rst +++ b/doc/userguide/configuration/global-thresholds.rst @@ -113,7 +113,7 @@ Syntax: :: suppress gen_id , sig_id - suppress gen_id , sig_id , track , ip + suppress gen_id , sig_id , track , ip Examples: @@ -129,6 +129,11 @@ Other possibilities/examples:: suppress gen_id 1, sig_id 2003614, track by_src, ip 217.110.97.128/25 suppress gen_id 1, sig_id 2003614, track by_src, ip [192.168.0.0/16,10.0.0.0/8,172.16.0.0/12] suppress gen_id 1, sig_id 2003614, track by_src, ip $HOME_NET + suppress gen_id 1, sig_id 2003614, track by_either, ip 217.110.97.128/25 + +In the last example above, the ``by_either`` tracking means that if either +the ``source ip`` or ``destination ip`` matches ``217.110.97.128/25`` the +rule with sid 2003614 is suppressed. .. _global-thresholds-vs-rule-thresholds: -- 2.47.2