Actions
Feature #5466
closeddetect: allow alert-then-pass logic
Effort:
Difficulty:
Label:
Description
Currently pass acts as a noalert rule that stops further alerting.
Some usecases have been identified in which ppl want a "alert then pass" in a single rule. Currently they are forced to express this in 2 rules, an alert rule and a pass rule, where the action order and or priorities needs to be setup such that the alert rule is evaluated first.
We do support the following: alert .... (bypass; ...).
I think we could extend the config rule keyword for this.
E.g. something like:alert ... (config:logging disable, type alert, scope flow;)
The behavior would still need to log the current alert, so it needs a bit of thought on how to express this.
Actions