Supress notices

Zeek
1

Do notice suppressions only suppress that notice type based upon the identifier? So if the identifier can match across multiple notice types will it suppress those other notice types as well? Dumb question probably, but just want to verify.

Thanks,
Brian

2


It suppresses based on the combination of the $note field and the $identifier field. If your notice doesn’t have an $identifier field defined for it, no suppression will occur.

  .Seth