Issues with thresholding and alerts

[Flav74]

Hello all,
I want to ignore several alerts that point to the same address. So I modified the Global pillar /opt/so/saltstack/local/pillar/global.sls and I add this :
suricata:
config:
vars:
address-groups:
EXCLUSION_HTTP: '[X.X.X.X, Y.Y.Y.Y, Z.Z.Z.Z]'
thresholding:
sids:
2006380:
gen_id: 1
track: by_dst
ip: $EXCLUSION_HTTP
But it seems not working because I have always alerts on this rule and theses IPs...
Could you help me?
Just for information, I begin with Security Onion

[InfosecGoon]

Rather than thresholding, you might be better off modifying the rule to handle this.

Try this instead, from the Manager node:

so-rule modify add 2006380 'any any' '![$EXCLUSION_HTTP] any'

That will modify the rule to fire on any destination IP that is NOT contained in the variable EXCLUSION_HTTP.

[Flav74]

Thank you, it's working!