Skip to main content
lwhitworth
New Member
May 26, 2016
Question

Disable one specific IPS signature

  • May 26, 2016
  • 0 replies
  • 3389 views

Figure I'm missing something obvious here.  Our IPS logs are absolutely spammed by the "TCP.Split.Handshake.signature" rule (2000 or so every 5 minutes).  I'd like to disable just this rule and this rule only.  Is there a way?  I've attached a pic of how we've currently go the IPS rules set, which is to do it by severity.