/etc/snort/threshold.conf is in snort-common 2.9.2.2-3.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 | # Configure Thresholding and Suppression
# ======================================
#
# The threshold command is deprecated. Use detection_filter for thresholds
# within a rule and event_filter for standalone threshold configurations.
# Please see README.filters for more information on filters.
#
# Thresholding:
#
# This feature is used to reduce the number of logged alerts for noisy rules.
# This can be tuned to significantly reduce false alarms, and it can also be
# used to write a newer breed of rules. Thresholding commands limit the number
# of times a particular event is logged during a specified time interval.
#
# There are 3 types of event_filters:
#
# 1) Limit
# Alert on the 1st M events during the time interval, then ignore
# events for the rest of the time interval.
#
# 2) Threshold
# Alert every M times we see this event during the time interval.
#
# 3) Both
# Alert once per time interval after seeing M occurrences of the
# event, then ignore any additional events during the time interval.
#
# Threshold commands are formatted as:
#
# event_filter gen_id gen-id, sig_id sig-id, \
# type limit|threshold|both, track by_src|by_dst, \
# count n , seconds m
#
# Limit to logging 1 event per 60 seconds:
#
# event_filter gen_id 1, sig_id 1851, type limit, \
# track by_src, count 1, seconds 60
#
# Global Threshold - Limit to logging 1 event per 60 seconds per IP triggering
# each rule (rules are gen_id 1):
#
# event_filter gen_id 1, sig_id 0, type limit, track by_src, count 1, seconds 60
#
# Global Threshold - Limit to logging 1 event per 60 seconds per IP triggering
# any alert for any event generator:
#
# event_filter gen_id 0, sig_id 0, type limit, track by_src, count 1, seconds 60
#
# Suppression:
#
# Suppression commands are standalone commands that reference generators and
# sids and IP addresses via a CIDR block (or IP list). This allows a rule to be
# completely suppressed, or suppressed when the causitive traffic is going to
# or comming from a specific IP or group of IP addresses.
#
# Suppress this event completely:
#
# suppress gen_id 1, sig_id 1852
#
# Suppress this event from this IP:
#
# suppress gen_id 1, sig_id 1852, track by_src, ip 10.1.1.54
#
# Suppress this event to this CIDR block:
#
# suppress gen_id 1, sig_id 1852, track by_dst, ip 10.1.1.0/24
#
|