Playbook rules still generating alerts after set to inactive or disabled #1951
-
After initially activating critical & high playbook rules, I wanted to filter some generating false positives like Renamed Powershell & Highly Relevant Renamed Binary. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment
-
We recently fixed a bug that was causing inactive Plays to continue to alert - that fix will be available in our next release. For now, you can delete the yaml files in |
Beta Was this translation helpful? Give feedback.
We recently fixed a bug that was causing inactive Plays to continue to alert - that fix will be available in our next release.
For now, you can delete the yaml files in
/opt/so/rules/elastalert/playbook/
and then runsudo so-playbook-sync
- this will manually turn off the alerting for Plays that are currently inactive.