AIP-SSM - Disabling a Signature for a specific host

Unanswered Question
May 31st, 2007


I am using an ASA-5510 with AIP-SSM, running 5.1 E1.

I am getting a lot of false positives from one internal relating to a TCP SYN Sweep.

I would like these not to be logged for this single host, but don't wish to globally disable or retire the signature.

Is this possible and if so, how?

Thanks in advance,


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.3 (3 ratings)
PAUL GILBERT ARIAS Wed, 06/06/2007 - 20:50

Dave, if you want to avoid the false positives for a signature you can create an event action filter and there you can specify the desired host and you can tell which action to filter, in this case you can filter the produce alert. Please check this link:

I hope it helps


This Discussion