• Support
  • Forums
  • Blogs

Suricata theshold


Big Time
edited July 2014 in AlienVault USM Appliance > Sensor
Good day!
Forgive me if this question has already been asked, I could not find a solution.
As IDS system i have Suricata. Snort is turn off.
Previously, I used Snort, and I knew how to configure theshold to clean unusefull events from SIEM - i configure /etc/snort/theshold
and add suppress gen_id 1, sig_id XXXXXX if i need ignore event or add event_filter gen_id 1, sig_id XXXXXX to filter it.
How i can do this with Suricata?
Thanks for the help!

Share post:

Best Answer

  • Answer ✓
    Just execute:
    cp /etc/suricata/alienvault.conf /etc/suricata/threshold.config
This discussion has been closed.