Configure Thresholding and Suppression Snort

Thresholding:
This feature is used to reduce the number of logged alerts for noisy rules.
This can be tuned to significantly reduce false alarms, and it can also be used to write a newer breed of rules. Thresholding commands limit the number# of times a particular event is logged during a specified time interval.
 
Edit:
#nano /etc/snort/threshold.conf
 
Format
 
The suppress configuration has two forms:
suppress \
        gen_id <gid>, sig_id <sid>

 

suppress \
        gen_id <gid>, sig_id <sid>, \
        track <by_src|by_dst>, ip <ip-list>

 

Example:

# snort: "GPL ICMP_INFO PING *NIX"
suppress gen_id 1, sig_id 2100366

 

Option Description
gen_id <gid>

Specify the generator ID of an associated rule. gen_id 0, sig_id 0 can be used to specify a "global" threshold that applies to all rules.

sig_id <sid>

Specify the signature ID of an associated rule. sig_id 0 specifies a "global" filter because it applies to all sig_ids for the given gen_id.

track by_src|by_dst

Suppress by source IP address or destination IP address. This is optional, but if present, ip must be provided as well.

ip <list>

Restrict the suppression to only source or destination IP addresses (indicated by track parameter) determined by < list >. If track is provided, ip must be provided as well.

 

#This event is generated when an attempt is made to gain access to private resources using Samba.
suppress gen_id 1, sig_id 536
#GPL SHELLCODE x86 NOOP
suppress gen_id 1, sig_id 648
#GPL SHELLCODE x86 0x90 unicode NOOP
suppress gen_id 1, sig_id 653
#This set of instructions can be used as a NOOP to pad buffers on an x86 architecture machines. 
suppress gen_id 1, sig_id 1390
#This event is generated when an attempt is made to return to a web client a file with a Class ID (CLSID) embedded in the file.
suppress gen_id 1, sig_id 8375
#This event is generated when network traffic that indicates download of executable content is being used.
suppress gen_id 1, sig_id 11192
#This event is generated when an attempt is made to exploit a known vulnerability in Safari.
suppress gen_id 1, sig_id 12286
#This event is generated when an attempt is made to exploit a known vulnerability in an ActiveX control.
suppress gen_id 1, sig_id 15147
#This rule generates events when a portable executable file is downloaded.
suppress gen_id 1, sig_id 15306
#This event is generated when obfuscated javascript containing excessive fromCharCode is detected.
suppress gen_id 1, sig_id 15362
#FILE-IDENTIFY download of executable content - x-header  -> stops windows download
suppress gen_id 1, sig_id 16313
#WEB-CLIENT Microsoft Internet Explorer userdata behavior memory corruption attempt
suppress gen_id 1, sig_id 16482
#This event is generated when an attempt is made to exploit a known vulnerability in internet security.
suppress gen_id 1, sig_id 17458
#This event is generated when an attempt is made to exploit a known vulnerability in firefox.
suppress gen_id 1, sig_id 20583
#This event is generated when an attempt is made to exploit a known vulnerability in adobe air.
suppress gen_id 1, sig_id 23098
#FILE-IDENTIFY Armadillo v1.71 packer file magic detected
suppress gen_id 1, sig_id 23256
#This event is generated when an attempt is made to exploit a known vulnerability in adobe air.
suppress gen_id 1, sig_id 24889
#ET P2P? BitTorrent? peer sync
suppress gen_id 1, sig_id 2000334
#ET WEB_CLIENT Possible HTTP 403 XSS Attempt (External Source)
suppress gen_id 1, sig_id 2010516
#ET SHELLCODE Possible Call with No Offset TCP Shellcode
suppress gen_id 1, sig_id 2012088
#ET SHELLCODE Excessive Use of HeapLib? Objects Likely Malicious Heap Spray Attempt
suppress gen_id 1, sig_id 2013222
#ET INFO Packed Executable Download
suppress gen_id 1, sig_id 2014819
#ET INFO EXE - Served Attached HTTP
suppress gen_id 1, sig_id 2014520
#GPL SHELLCODE x86 inc ebx NOOP
suppress gen_id 1, sig_id 2101390
#GPL WEB_CLIENT PNG large colour depth download attempt
suppress gen_id 1, sig_id 2103134
#ET POLICY PE EXE or DLL Windows file download
suppress gen_id 1, sig_id 2000419
#ET POLICY Unusual number of DNS No Such Name Responses
suppress gen_id 1, sig_id 2003195
#ET POLICY Suspicious inbound to MSSQL port 1433
suppress gen_id 1, sig_id 2010935
#ET POLICY Suspicious inbound to mySQL port 3306
suppress gen_id 1, sig_id 2010937
#ET SHELLCODE Possible Call with No Offset TCP Shellcode
suppress gen_id 1, sig_id 2012086
#ET SHELLCODE Possible Call with No Offset UDP Shellcode
suppress gen_id 1, sig_id 2012087
#ET SHELLCODE Possible Call with No Offset UDP Shellcode
suppress gen_id 1, sig_id 2012089
#ET POLICY Protocol 41 IPv6 encapsulation potential 6in4 IPv6 tunnel active
suppress gen_id 1, sig_id 2012141
#ET POLICY Executable served from Amazon S3
suppress gen_id 1, sig_id 2013414
#ET POLICY Outdated Windows Flash Version IE
suppress gen_id 1, sig_id 2014726
#ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management
suppress gen_id 1, sig_id 2013504
#BLEEDING-EDGE RBN Known Russian Business Network Traffic - Known Trojan C&Cs (bleeding-rbn.rules)
suppress gen_id 1, sig_id 2406003
#ET RBN Known Russian Business Network Monitored Domains
suppress gen_id 1, sig_id 2406067
#ET RBN Known Russian Business Network Monitored Domains
suppress gen_id 1, sig_id 2406069
#ET TFTP Outbound TFTP Read Request -- VONAGE
suppress gen_id 1, sig_id 2008120
#ET SHELLCODE Common 0a0a0a0a Heap Spray String
suppress gen_id 1, sig_id 2012252
#ET INFO DYNAMIC_DNS Query to *.dyndns. Domain
suppress gen_id 1, sig_id 2012758
#ET INFO EXE - OSX Disk Image Download
suppress gen_id 1, sig_id 2014518
#ET INFO PDF Using CCITTFax Filter
suppress gen_id 1, sig_id 2015561
#GPL ICMP_INFO PING *NIX
suppress gen_id 1, sig_id 2100366
#GPL ICMP_INFO
suppress gen_id 1, sig_id 2100368
#GPL SHELLCODE x86 stealth NOOP
suppress gen_id 1, sig_id 2100651
#GPL SHELLCODE x86 0xEB0C NOOP
suppress gen_id 1, sig_id 2101424
#GPL SHELLCODE x86 0x90 NOOP unicode
suppress gen_id 1, sig_id 2102314
#WEB-CLIENT libpng malformed chunk denial of service attempt
suppress gen_id 3, sig_id 14772
#(http_inspect) DOUBLE DECODING ATTACK
suppress gen_id 119, sig_id 2
#(http_inspect) BARE BYTE UNICODE ENCODING
suppress gen_id 119, sig_id 4
#(http_inspect) IIS UNICODE CODEPOINT ENCODING
suppress gen_id 119, sig_id 7
#(http_inspect) NON-RFC DEFINED CHAR [**]
suppress gen_id 119, sig_id 14
#(http_inspect) UNKNOWN METHOD
suppress gen_id 119, sig_id 31
#(http_inspect) SIMPLE REQUEST
suppress gen_id 119, sig_id 32
#(http_inspect) UNESCAPED SPACE IN HTTP URI
suppress gen_id 119, sig_id 33
#(http_inspect) NO CONTENT-LENGTH OR TRANSFER-ENCODING IN HTTP RESPONSE
suppress gen_id 120, sig_id 2
#(http_inspect) NO CONTENT-LENGTH OR TRANSFER-ENCODING IN HTTP RESPONSE
suppress gen_id 120, sig_id 3
#(http_inspect) HTTP RESPONSE HAS UTF CHARSET WHICH FAILED TO NORMALIZE
suppress gen_id 120, sig_id 4
#(http_inspect) HTTP RESPONSE GZIP DECOMPRESSION FAILED
suppress gen_id 120, sig_id 6
#(http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
suppress gen_id 120, sig_id 8
#(http_inspect) JAVASCRIPT OBFUSCATION LEVELS EXCEEDS 1
suppress gen_id 120, sig_id 9
#(http_inspect) JAVASCRIPT WHITESPACES EXCEEDS MAX ALLOWED
suppress gen_id 120, sig_id 10
#(http_inspect) MULTIPLE ENCODINGS WITHIN JAVASCRIPT OBFUSCATED DATA
suppress gen_id 120, sig_id 11
#(portscan) UDP PORTSWEEP
suppress gen_id 122, sig_id 19
#(portscan) UDP Filtered Portscan
suppress gen_id 122, sig_id 21
#(portscan) UDP Filtered Decoy Portscan
suppress gen_id 122, sig_id 22
#(portscan) UDP PORTSWEEP FILTERED
suppress gen_id 122, sig_id 23
#(portscan) ICMP PORTSWEEP FILTERED
suppress gen_id 122, sig_id 26
#(spp_frag3) Bogus fragmentation packet. Possible BSD attack
suppress gen_id 123, sig_id 10
#(smtp) Attempted response buffer overflow: 1448 chars
suppress gen_id 124, sig_id 3
#(ftp_telnet) Invalid FTP Command
suppress gen_id 125, sig_id 2
#(ssp_ssl) Invalid Client HELLO after Server HELLO Detected
suppress gen_id 137, sig_id 1
##SENSITIVE DATA DISABLE##
#Credit Card Numbers
suppress gen_id 138, sig_id 2
#U.S. Social Security Numbers (with dashes)
suppress gen_id 138, sig_id 3
#U.S. Social Security Numbers (w/out dashes)
suppress gen_id 138, sig_id 4
#Email Addresses
suppress gen_id 138, sig_id 5
#U.S. Phone Numbers
suppress gen_id 138, sig_id 6
#(spp_sip) Empty request URI
suppress gen_id 140, sig_id 2
#(spp_sip) URI is too long
suppress gen_id 140, sig_id 3
#(spp_sip) Maximum dialogs within a session reached
suppress gen_id 140, sig_id 27
#(IMAP) Unknown IMAP4 command
suppress gen_id 141, sig_id 1
#(IMAP) Unknown IMAP4 response
suppress gen_id 141, sig_id 2
###
#ET POLICY PE EXE or DLL Windows file download HTTP
suppress gen_id 1, sig_id 2018959
#ET POLICY HTTP traffic on port 443 (POST)
suppress gen_id 1, sig_id 2013926
#ET POLICY Data POST to an image file (gif)
suppress gen_id 1, sig_id 2010066
#ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
suppress gen_id 1, sig_id 2016150
#ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
suppress gen_id 1, sig_id 2016149
#ET POLICY Dropbox.com Offsite File Backup in Use
suppress gen_id 1, sig_id 2012647
#ET POLICY Logmein.com/Join.me SSL Remote Control Access
suppress gen_id 1, sig_id 2014756
#ET POLICY Pandora Usage
suppress gen_id 1, sig_id 2014997
#ET POLICY iTunes User Agent
suppress gen_id 1, sig_id 2002878
#ET POLICY Windows-Based OpenSSL Tunnel Outbound
suppress gen_id 1, sig_id 2012078
#ET POLICY Executable and linking format (ELF) file download
suppress gen_id 1, sig_id 2000418
#ET POLICY Carbonite.com Backup Software User-Agent (Carbonite Installer)
suppress gen_id 1, sig_id 2009801
#ET POLICY TeamViewer Dyngate User-Agent
suppress gen_id 1, sig_id 2009475
#ET POLICY Internal Host Retrieving External IP via ipchicken.com - Possible Infection
suppress gen_id 1, sig_id 2009020
#ET POLICY Internal Host Retrieving External IP via showmyip.com - Possible Infection
suppress gen_id 1, sig_id 2008989
#ET POLICY Internal Host Retrieving External IP via cmyip.com - Possible Infection
suppress gen_id 1, sig_id 2008988
#ET POLICY Internal Host Retrieving External IP via showip.net - Possible Infection
suppress gen_id 1, sig_id 2008987
#ET POLICY Internal Host Retrieving External IP via whatismyip.com - Possible Infection
suppress gen_id 1, sig_id 2008986
#ET POLICY Internal Host Retrieving External IP via whatismyip.com Automation Page - Possible Infection
suppress gen_id 1, sig_id 2008985
#ET POLICY Logmein.com Host List Download
suppress gen_id 1, sig_id 2007765
#ET POLICY Logmein.com Update Activity
suppress gen_id 1, sig_id 2007766
#ET POLICY Microsoft TEREDO IPv6 tunneling
suppress gen_id 1, sig_id 2003155
#ET POLICY Netflix On-demand User-Agent
suppress gen_id 1, sig_id 2007638
#ET POLICY TeamViewer Keep-alive outbound
suppress gen_id 1, sig_id 2008794
#ET POLICY TeamViewer Keep-alive inbound
suppress gen_id 1, sig_id 2008795
#APP-DETECT TeamViewer remote administration tool outbound connection attempt
suppress gen_id 1, sig_id 34463
#ET POLICY Dropbox DNS Lookup - Possible Offsite File Backup in Use
suppress gen_id 1, sig_id 2020565
#ET INFO JAVA - ClassID
suppress gen_id 1, sig_id 2016360
#ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns.* domain
suppress gen_id 1, sig_id 2013097
#ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
suppress gen_id 1, sig_id 2016538
#ET P2P Bittorrent P2P Client User-Agent (Deluge 1.x.x)
suppress gen_id 1, sig_id 2011704
#ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5.
suppress gen_id 1, sig_id 2016870
#ET POLICY Vulnerable Java Version 1.6.x Detected
suppress gen_id 1, sig_id 2011582
#ET POLICY Vulnerable Java Version 1.8.x Detected
suppress gen_id 1, sig_id 2019401
#ET MALWARE Adware.iBryte.B Install
suppress gen_id 1, sig_id 2018194
#ET POLICY HTTP traffic on port 443 (HEAD)
suppress gen_id 1, sig_id 2013927
#ET POLICY Possible IP Check api.ipify.org
suppress gen_id 1, sig_id 2019512
#ET POLICY BingBar ToolBar User-Agent (BingBar)
suppress gen_id 1, sig_id 2013715
#ET POLICY User-Agent (Launcher)
suppress gen_id 1, sig_id 2010645
#ET INFO JAVA - document.createElement applet
suppress gen_id 1, sig_id 2015707

##OPTIONAL RULES BELOW##
##UNCOMMENT SUPPRESS LINE TO ENABLE##

#(ftp_telnet) FTP bounce attempt
#suppress gen_id 125, sig_id 8
#ET TOR Known Tor Relay/Router (Not Exit) Node UDP Traffic group 647
#suppress gen_id 1, sig_id 2523293
#ET TOR Known Tor Exit Node UDP Traffic group 89
#suppress gen_id 1, sig_id 2520177
#ET TOR Known Tor Relay/Router (Not Exit) Node UDP Traffic group 89
#suppress gen_id 1, sig_id 2522177
#ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Reserved Bit Set - Likely Kazy
#suppress gen_id 1, sig_id 2014703
#ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 8 through 15 set - Likely Kazy
#suppress gen_id 1, sig_id 2014702
#FILE-PDF Adobe Acrobat Reader incomplete JP2K image geometry exploit attempt
#suppress gen_id 1, sig_id 25459
#ET WEB_CLIENT Possible HTTP 500 XSS Attempt (External Source)
#suppress gen_id 1, sig_id 2010525
#ET POLICY SSLv3 outbound connection from client vulnerable to POODLE attack
#suppress gen_id 1, sig_id 2019416
#ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System
#suppress gen_id 1, sig_id 2007695
#ET SCAN Potential SSH Scan OUTBOUND
#suppress gen_id 1, sig_id 2003068
#ET MALWARE W32/OpenCandy Adware Checkin
#suppress gen_id 1, sig_id 2014122
#ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com
#suppress gen_id 1, sig_id 2015633
#ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com
#suppress gen_id 1, sig_id 2015634
#ET INFO DYNAMIC_DNS HTTP Request to a no-ip Domain
#suppress gen_id 1, sig_id 2013744
#ET INFO DYNAMIC_DNS HTTP Request to a dns-stuff.com Domain *.dns-stuff.com
#suppress gen_id 1, sig_id 2014867
#ET INFO DYNAMIC_DNS Query to dns-stuff.com Domain *.dns-stuff.com
#suppress gen_id 1, sig_id 2014868

Credits

Suppress ListSuppress ListSuppress List