test_tuning
Apply one structured Snort 3 tuning change to a copied detection, re-run the same pcap, and compare before/after alert counts per SID to validate the decision.
Instructions
Apply one structured change to a copy, re-run the same pcap, and return before/after counts per SID. Records a decision. change.kind is one of: suppress: {kind, sid, track:'by_src'|'by_dst', ip} event_filter: {kind, sid, type:'limit'|'threshold'|'both', track, count, seconds} rate_filter: {kind, sid, track, count, seconds, new_action, timeout} rule_edit: {kind, sid, rule:''} Example: test_tuning(before_run_id="r-0002", change={"kind":"suppress","sid":1000042,"track":"by_src","ip":"10.0.4.20"}, reason="known scanner")
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| change | Yes | ||
| reason | Yes | ||
| before_run_id | Yes |