Snorby/snorby — Issue #175: General Question on Classification
Author: dmatthewsbnd251
Created: 2012-01-06 15:14:50+00:00
State: open

I am experimenting with different snort guis at the moment. I really like Snorby so far and the real plus is the ability to classify. When using the demo I am able to classify events as false positive, however, they still show up in the queue. What makes events disappear from the queue? Will events marked as false positives still show up as events in other graphs? My preference would of course make it so that events classified as false positives don't really show up in the queue again, in any graphs, and pretty much just live in the false positive configuration for reference/editing when and if needed.

I know my question is not exactly straight forward but could someone help me understand the expected behavior of classification and how that impacts other areas of this tool.