exclude destination address from sig

Unanswered Question

New to Cisco IPS....

I wish to EXCLUDE a single destination IP address from a signature -- have the sig fire it it trips for all BUT one IP address (which is a confirmed false positive).

The sig name is BO2K-UDP. want to have it ignore events for a single destination but have it trip normally for all other destinations. Thanks.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)


This Discussion