Suppressing alerts

Disable alerting — During policy creation/modification, you can disable the alert for one or more attacks. This is not attack detection disabling, just alert disabling. The Sensor still detects the attack and can send an automatic response, if configured. (If no response is configured, nothing is done when the attack is detected.)

Auto Acknowledge — Also during policy creation, you have the option of automatically acknowledging a detected attack. The Auto-Acknowledge feature suppresses the alert from the Attack Log by marking the alert as acknowledged. You can also create new auto acknowledgement rules for the alerts.

Alert throttling — Alert throttling (seen as Alerting Options in the Manager interface) enables you to set a suppression limit for a singular Exploit attack, which originates from one attacker, targets a single destination IP, and is detected by the same VIPS (interface or sub-interface) multiple times within a limited time frame. Exploit throttling limits the number of duplicate alerts that are sent to the Manager from a Sensor. Throttling is very effective against repetitive Exploit attacks where a attacker IP address is spoofed and generates a high number of alerts.

For more details, refer to Configure alert suppression with packet log response topic in IPS Administration section.