On Sat, Mar 19, 2005 at 11:24:35AM -0800, Vicki Brown wrote: > I could give it a score of 0 but I'd like to simply say "don't even test > against it". > > I'm getting tired of seeing ALL_TRUSTED. We run SMTP; they connect directly > to us; there are no interim hosts. > > I could edit the underlying rule file but then I'd have to do that after any > update. is there an "off switch" I've missed seeing?
score RULE 0 is the off switch. SA does not run rules that have their score set to 0. Michael
pgphnZ5zZhyja.pgp
Description: PGP signature
