use match instead of srcip and use two rules

<rule id="100326" level="5"> 
        <if_sid>xxxx</if_sid> 
        <srcip>XXX.XXX.XXX.XXX</srcip> 
        <description>Suppress Alerts from Server</description> 
</rule>

<rule id="100327" level="5" > 
        <if_sid>xxxx</if_sid> 
        <match>server1</match> 
        <description>Suppress Alerts from Server</description> 
</rule>

Reply via email to