specifically tuning sig 3030

[brecore]

I am receiving a number of these alarms all from internal hosts. Specifically how would you tune this signature to reduce the number? Or would you want to see all of these alarms? Or just filter it entirely for internal hosts? I am wondering if it would be similar to sig2100, where I set it to summarize instead of fireall.

Thank You

[ywadhavk]

3030 can be viewed as a normal behaviour if its on the inside of the network. You may just want to filter that host alltogether. Or as you said can tune it to GlobalSummarize.

thanks,

yatin