|
|
|
@ -13,11 +13,11 @@
|
|
|
|
|
# suppress gen_id <gid>, sig_id <sid>
|
|
|
|
|
# suppress gen_id <gid>, sig_id <sid>, track <by_src|by_dst>, ip <ip|subnet>
|
|
|
|
|
#
|
|
|
|
|
# The options are documented at https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Global-Thresholds
|
|
|
|
|
# The options are documented at https://suricata.readthedocs.io/en/latest/configuration/global-thresholds.html
|
|
|
|
|
#
|
|
|
|
|
# Please note that thresholding can also be set inside a signature. The interaction between rule based thresholds
|
|
|
|
|
# and global thresholds is documented here:
|
|
|
|
|
# https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Global-Thresholds#Global-thresholds-vs-rule-thresholds
|
|
|
|
|
# https://suricata.readthedocs.io/en/latest/configuration/global-thresholds.html#global-thresholds-vs-rule-thresholds
|
|
|
|
|
|
|
|
|
|
# Limit to 10 alerts every 10 seconds for each source host
|
|
|
|
|
#threshold gen_id 0, sig_id 0, type threshold, track by_src, count 10, seconds 10
|
|
|
|
|