The signature generates false positives on DNS traffic.An example is a DNS query with an Transaction ID: 0xE30FAt networks with a lot of DNS traffic the signature will produces 30+ alarms per day.

We're getting alarms with Victim address = n/a and attacker/victim port = n/a for this signature. We've tried to change the Event count key to "Attacker and victim addresses" and/or "Attacker and victim addresses and ports" but there are still alot o...

I want this signature to have the old behaviour as it had in 4.x. So I changed the Keys from Axxx to Axxp. Also I wanted to exclude port 80 and 443 entirely, so I added 0-79,81-442,444-65535 to Port Range.This does not seem to work. The following sce...

Should this signature trigger for:GET /\r\nI thought it should trigger for something like:GET /\rHTTP/1.1\r\n\r\n