Suricata alert only option

Security Intrusion Prevention
1

Suricata is powerful, efficient, and comprehensive, but with the multitude of rules available, I admit I get lost and generate many false positives.

I discovered that in the initial project, the “alert only” option could be enabled (it allows alerts without blocking, which seems perfect for testing and adding exceptions before production deployment).

Could this “alert only” option be integrated into IPFire (or is it already integrated somewhere)?

Thank you for your answers.

2

Select the edit pencil for the rules provider you want to only monitor and then enable the checkbox for Monitor traffic only.

3 Likes
3

Okay, I admit I wasn’t very good there.

As always, @bonnietwin relevant and super responsive, thank you very much !

4

No problem. As the default is blocking it can be very easy to miss where it needs to be changed for monitoring.

1 Like