# Configure Thresholding and Suppression
# ======================================
#
# Thresholding:
#
# This feature is used to reduce the number of logged alerts for noisy rules.
# This can be tuned to significantly reduce false alarms, and it can also be
# used to write a newer breed of rules. Thresholding commands limit the number
# of times a particular event is logged during a specified time interval.
# There are 3 types of thresholding:
#
#        1) Limit
#           Alert on the 1st M events during the time interval, then ignore
#           events
#           for the rest of the time interval.
#        2) Threshold
#           Alert every M times we see this event during the time interval.
#        3) Both
#           Alert once per time interval after seeing M occurrences of the
#           event,
#           then ignore any additional events during the time interval.
#
# Threshold commands are formatted as:
# threshold gen_id gen-id, sig_id sig-id, type limit|threshold|both, track
# by_src|by_dst, count n , seconds m

# Threshold command for TCP Distributed Portscans
threshold gen_id 122, sig_id 4, type threshold, track by_src, count 20 , seconds 60

# Threshold command for TCP Portscans
threshold gen_id 122, sig_id 1, type threshold, track by_src, count 20 , seconds 60
#           for the rest of the time interval.
#        2) Threshold
#           Alert every M times we see this event during the time interval.
#        3) Both
#           Alert once per time interval after seeing M occurrences of the
#           event,
#           then ignore any additional events during the time interval.
#
# Threshold commands are formatted as:
# threshold gen_id gen-id, sig_id sig-id, type limit|threshold|both, track
# by_src|by_dst, count n , seconds m

# Threshold command for TCP Distributed Portscans
threshold gen_id 122, sig_id 4, type threshold, track by_src, count 20 , seconds 60

# Threshold command for TCP Portscans
threshold gen_id 122, sig_id 1, type threshold, track by_src, count 20 , seconds 60

# Threshold command for TCP Portsweeps
threshold gen_id 122, sig_id 3, type threshold, track by_src, count 15, seconds 60

# Threshold command for UDP Portscans
threshold gen_id 122, sig_id 17, type threshold, track by_src, count 20 , seconds 60

# Limit to logging 1 event per 60 seconds
# threshold gen_id 1, sig_id 1851, type limit, track by_src, count 1, seconds
# 60

# Global Threshold - Limit to logging 1 event per 60 seconds per IP triggering
# each rule (rules are gen_id 1).
# threshold gen_id 1, sig_id 0, type limit, track by_src, count 1, seconds 60

# Global Threshold - Limit to logging 1 event per 60 seconds per IP triggering
# any alert for any event generator
# threshold gen_id 0, sig_id 0, type limit, track by_src, count 1, seconds 60
#
# Thresholding does not need to be a stand-alone command, and can instead be
# written directly into a rule. Please see README.thresholding for more
# information on thresholding.
#
# Suppression:
#
# Suppression commands are standalone commands that reference generators and
# sids and IP addresses via a CIDR block. This allows a rule to be completely
# suppressed, or suppressed when the causitive traffic is going to or comming
# from a specific IP or group of IP addresses.
#
#  Suppress this event completely
#
# suppress gen_id 1, sig_id 1852
#
#  Suppress this event from this IP
#
# suppress gen_id 1, sig_id 1852, track by_src, ip 10.1.1.54
#
#  Suppress this event to this CIDR block
#
# suppress gen_id 1, sig_id 1852, track by_dst, ip 10.1.1.0/24

# known tftp server
suppress gen_id 1, sig_id 518, track by_dst, ip 192.111.5.10

# only allowed public ftp server
suppress gen_id 1, sig_id 1530, track by_dst, ip 192.246.96.210

# false postive, reply back snmp traffic
suppress gen_id 1, sig_id 1980, track by_dst, ip 192.111.56.192

#Suppress Tagged Packet
suppress gen_id 2, sig_id 1

#Suppress TCP Portscans
#suppress gen_id 122, sig_id 1

#Suppress TCP Decoy Portscans
suppress gen_id 122, sig_id 2

#Suppress TCP Portsweeps
#suppress gen_id 122, sig_id 3

#Suppress UDP Portscans
#suppress gen_id 122, sig_id 17

#Suppress UDP Decoy Portscans
suppress gen_id 122, sig_id 18

#Suppress UDP Portsweeps
suppress gen_id 122, sig_id 19

#Suppress Open Port
suppress gen_id 122, sig_id 27

#Suppress  X-Link2State length greater than 1024
suppress gen_id 124, sig_id 1