I am trying to build the below YARA L rule
and i am seeing the same IP triggering after every couple of hours , how can i suppress them to avoid duplicate ticket creation .
events:
$e.metadata.event_type = "NETWORK_CONNECTION"
$e.metadata.vendor_name = "Check Point"
$e.security_result.action != "BLOCK"
(
$e.target.ip != ""
and $e.target.ip != "0.0.0.0"
and $e.target.ip in cidr %cidr_rfc_1918
and $dip = $e.target.ip
) and
($e.principal.ip != ""
and $e.principal.ip != "0.0.0.0"
and not $e.principal.ip in cidr %cidr_rfc_1918
and $sip = $e.principal.ip)
$sip in %IOC_IP
match:
$sip over 60m
