cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
310
Views
0
Helpful
2
Replies

Filters seemingly ignored?

mattgioia
Level 1
Level 1

'lo all.

It seems in the last 2 days or so, one of our filters is seemingly being ignored. I double checked on the sensor itself, and the filter is still in tact and looks the same as ever, however now our event viewer is getting filled up with the traffic that it used to pear out. Has anyone else had this problem? Any thoughts as to why this would happen? The only changes we've made recently have been sig updates, but nothing we've done has seemed to coincide with when the problem started.

2 Replies 2

bbenton
Level 1
Level 1

I have more than one filter being ignored. I've only updated sigs as well. I think my problem started at S70. Re-applying them from IDSMC doesn't seem to help either.

Anyone else?

kwinkelman
Level 1
Level 1

I'm seeing this as well. I've just disabled the alarm(s) for now as I don't really have time to mess with it.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: