I am receiving a number of these alarms all from internal hosts. Specifically how would you tune this signature to reduce the number? Or would you want to see all of these alarms? Or just filter it entirely for internal hosts? I am wondering if it would be similar to sig2100, where I set it to summarize instead of fireall.
Thank You