Theo Van Dinter wrote:
On Thu, Jul 07, 2005 at 04:34:03PM -0500, Kenneth S. wrote:
Is there anyway to configure SA so that if the ALL_TRUSTED rule is hit it
skips the Razor, DCC and Pyzor tests?
Not without modifying code.
You could probably create a set of meta-rules to counteract the scoring.
Something like...
meta TRUSTED_RAZOR RAZOR2_CHECK && ALL_TRUSTED
score TRUSTED_RAZOR -(scores assigned to RAZOR2_CHECK)
It won't save time or processing, but it will reduce the chances of FPs.
--
Kelson Vibber
SpeedGate Communications <www.speed.net>
