Log Exclusion with SNARE

Unanswered Question
Mar 16th, 2009
User Badges:

Does anyone know if SNARE can exclude logs to ship off to MARS? I have been trying but I cant find if its possible to do something like !7035 to exclude a specific event ID. They use a * to include all events, but I want an exclusion. Otherwise I would guess the only other way would be to exclude it from the event log all together, which I wouldnt want to do. Or even setup a drop rule in MARS to not log that event to the database, but then MARS is still doing the work and receiving the events.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)


This Discussion