Late to this thread but searching around. I have a device with a false positive for snort signature and attempting to create an exception between the source/dest w/o creating a bypass for the signature for all. Is this not possible? The rule is SSH_EVENT_RESPOVERFLOW which is due to a backup.  ... View more