SO 2.4.170: NIDS rule supression not working (rule tuning)

[zenon8000]

Version

2.4.170

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

32

Storage for /

200

Storage for /nsm

500

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I configured NIDS rule suppression for single source IP, but it's not working. I still receiving continous alerts from this source IP.

I think that I configured the suppression rule correctly. How can I suppress the source IP. I don't want to disable the rule. Just want to suppress from single source IP.

https://docs.securityonion.net/en/2.4/nids.html#managing-existing-nids-rules

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Is the configuration making it to the sensor(s)? sudo salt \*sensor file.read /opt/so/conf/suricata/threshold.conf

[zenon8000]

It seems that the exclusion activation takes lot of time. The exclusion started working around next day.