Excluding or Including Specific Signatures

After viewing events for several days and analyzing the traffic along with the source and destination addresses, you may want to turn certain signatures off and others on. There could be several reasons why you would want to exclude signatures. They range from too many alarms to false positives being generated by legitimate traffic patterns such as networking monitoring tools using ICMP to check that a node is alive. The ICMP would trigger most ICMP alarms even though the traffic is perfectly legitimate. This tuning process of the sensor by excluding signatures that are not pertinent to your network, or perhaps turning some on that were previously off, will add quite a bit of value to your security effort.