Add an exception IP by rule

[johan.lecerf]

Hi,

I would like to know if SourceFire has a way to add exceptions to rules for particular source/destination IP addresses.

For exemple :

This rule "OS-OTHER Bash CGI environment variable injection attempt" drops an important number of packets for this ip 10.0.0.1/32 ==> Only generates false positive events just for this IP

For this particular rule, I would like to add an IP exception to stop drop&generate event

Thanks in advance,

Best regards,