Disabling Specific Suricata Alert for Local SQL Server Access

[Carlos-mb]

Hi everyone,

I'm encountering a high volume of Suricata alerts regarding local IP addresses accessing our SQL server. I've been trying to find a solution to disable a specific Suricata alert when the source is within my HOME_NET and the destination is a particular SQL server IP address.

I've searched extensively but haven't found a clear answer. Any assistance on how to achieve this would be greatly appreciated.

Thanks!

[Carlos-mb]

Could this work?

Tunning -> Modify ->

Regex: \;)
Value: ; !(src_ip $HOME_NET; dst_ip $SQL_SERVERS);)

Regards
Carlos

[Carlos-mb]

Would it be possible to create a pass rule?

[dougburks]

Yes, you should be able to create a pass rule:
https://docs.securityonion.net/en/2.4/nids.html#adding-new-nids-rules
https://docs.suricata.io/en/latest/performance/ignoring-traffic.html#pass-rules

Another option might be to create a BPF:
https://docs.securityonion.net/en/2.4/bpf.html

[Carlos-mb]

Thanks!
I'll try it.