Intrusion Protection System URL Whitelist

[mrmarkuz (Markus Neuberger)]

You may just disable the affected rule in the category/section or do a whitelisting:

Disable suricata rule / whitelist

HI all, I’m looking for a way to disable one suricata rule by its SID without disabling whole category. Is it enough to put the SID taken from evebox in the file /etc/pulledpork/disablesid.conf followed by a signal-event nethserver-suricata-update and systemctl restart suricata ? What can I do if I would only whitelist an IP address to have it not filtered for any rule? BR Stefano