Update managing-alerts.rst

added information about adding multiple IPs/networks to a suppression threshold config using a comma
Security-Onion-Solutions · Dec 7, 2023 · b52cf82 · b52cf82
1 parent 9c12951
commit b52cf82
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/managing-alerts.rst b/managing-alerts.rst
@@ -140,6 +140,16 @@ For example, suppose you want to suppress SID 2013030 where the source IP addres
 	      track: by_src
               ip: 10.10.3.0/24
 
+If you want to suppress SID 2013030 for multiple IPs where source IP address is in the 10.10.3.0/24 subnet and also IP address 10.0.0.5 simply separate them with a comma:
+
+::
+
+	2013030:
+  	  - suppress:
+	      gen_id: 1
+	      track: by_src
+              ip: 10.10.3.0/24,10.0.0.5
+
 Flowbits
 --------