suppress all alerts for destination IP

[OrangeCat201]

Hello,
I have a backup server that generates alot of false positive alerts i have to clear out. How do i suppress alerts for a Destination IP and Port number for all alerts for that IP ?

[cm-ops]

You could work out an update by query in Dev Tools and target them something like (just an example IP and port, change them):

POST logs-suricata.alerts-so/_update_by_query
{
  "query": {
    "bool": {
       "must": [
        { "term": { "destination.ip": "192.168.10.101" } },
        { "term": { "destination.port": 445 } }
          
        ],
      "must_not": [
        {
          "term": {
            "event.acknowledged": true
          }
        }
      ]
    }
  },
    "script": {
    "source": "ctx._source.event.acknowledged = true",
    "lang": "painless"
    } 
}

[OrangeCat201]

How do I get to Dev tools or go about creating this?

[cm-ops]

https://www.elastic.co/docs/explore-analyze/query-filter/tools/console

The query above is what you would use.