Snort Rules¶
Rules¶
Use the Rules tab for the interface to configure individual rules in the enabled categories. Generally this page is only used to disable particular rules that may be generating too many false positives in a network environment. Be sure they are in fact truly false positives before taking the step of disabling a Snort rule!
Select a rules category from the Category: drop-down to view all the
assigned rules. Click the 
or 
icon at
the far-left of a row to toggle the rule’s state from enabled to disabled, or
click 
or 
to toggle from disabled to enabled.
The icon will change to indicate the state of the rule. At the top of the rule
list is a legend showing the icons used to indicate the current state of a rule.
