RecordOfExcludedPattern

[darrenb15]

I'm interested in exluding a signature from all source addresses but one. Do I create an exlude for the signature using a source of 'IN', then create an Include filter on the single address?

Are the rules hierarchical, in other words does a it make a difference if I put the Include filter ahead of the Exclude filter or vice versa?

Thanks,

D.

[pberiswill]

First, enter your exclusion for ALL source addresses:

RecordOfExcludedPattern 1234 * * *

This excludes ALL sub signatures of signature '1234' from ALL sources to ALL destinations.

Next, add back the source that you want to alarm:

RecordOfIncludedPattern 1234 * 10.20.1.1 *

This includes all sub-sigs of signature 1234 originating from IP '10.20.1.1' to any destination.

OR

RecordOfIncludedPattern 1234 * 10.20.1.1 IN

( If you only want it to fire when the destination is a protected asset )

Exclusions and Inclusions are processed based on the following rules:

All signatures have implied inclusion for all sources and all destinations by default.

ExcludedPatterns allow you to filter some signatures btwn specific sources/destinations.

IncludedPatterns are used to express exceptions to your expressed ExcludedPatterns. They can be considered as convenience patterns to simplify exclusions and are intended for exactly the situation you describe.

Simply put, an alarm will fire if it is not excluded or if it is included.

fire = ( !Excluded || Included )

Ordering on the Excluded/Included patterns makes no difference ...