Suppress IP

[mbaki]

Hi all,

Can I suppress just by a Source IP address? This IP performs a scan to our network and lights up our dashboard, and we know it's friendly, so how can I suppress the IP.

Thanks
Monah

[RollingMoses]

Check out the Threshold section toward the bottom of this page:
https://docs.securityonion.net/en/2.3/managing-alerts.html

[joeb1kenobe]

Use a BPF filter to ignore traffic from a particular IP address. Joe

On Thu, Jul 1, 2021 at 11:41 PM RollingMoses ***@***.***> wrote: Check out the Threshold section toward the bottom of this page: https://docs.securityonion.net/en/2.3/managing-alerts.html — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#4670 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAD6W6TX3IYJPC7MWKRM6E3TVUYP5ANCNFSM47VJSB2Q> .

-- Joe Brown

[DinhDiesel]

What about supressing a certain port from an IP? bc I still want other logs from that IP.