Forum Discussion
Attack Signature how to disable "Learn" & "Alarm" keep "Block" enabled
When looking at the attack signatures you see this kind of informations:
Signature Name Signature ID Learn Alarm Block Enabled
Automated client access "ms-office" 200021137 Yes Yes Yes ...
DRJ
Altocumulus
AltocumulusAs far as I know you can't change the learn/alarm/block settings for an individual signature, but you can for the signature set as explained by Leonardo.
You might be able to get around it by creating a new set containing just this signature if that's what you need.
