suggest_tuning_targets
Rank noisy SIDs in a Snort run by hit count, distinct sources/destinations, and source concentration to identify detection tuning targets.
Instructions
Rank the noisiest SIDs in a run by count, with distinct sources/destinations and how concentrated the hits are in one source. Example: suggest_tuning_targets(run_id="r-0002")
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | ||
| run_id | Yes |