Project

General

Profile

Actions

Feature #5466

open

detect: allow alert-then-pass logic

Added by Victor Julien 4 months ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Currently pass acts as a noalert rule that stops further alerting.

Some usecases have been identified in which ppl want a "alert then pass" in a single rule. Currently they are forced to express this in 2 rules, an alert rule and a pass rule, where the action order and or priorities needs to be setup such that the alert rule is evaluated first.

We do support the following: alert .... (bypass; ...).

I think we could extend the config rule keyword for this.

E.g. something like:
alert ... (config:logging disable, type alert, scope flow;)

The behavior would still need to log the current alert, so it needs a bit of thought on how to express this.

No data to display

Actions

Also available in: Atom PDF