Intrusion Protection Question

[gringoloco2000]

- Sorry, wrong area for this post.

Is there an easy way to set signatures to logging only for a "burn in/monitor" period and then then back to default protecting without having to go touch each one? That is a lot of clicking that I would like to avoid. I need to put this in as an IDS at first so that I can work out any false positives. I already had it kill my POP3 traffic as a false positive.

[amac]

I'll file a bug for this, I think I see what your talking about, maybe even like a back to defaults specifically for IPS is that along the lines of what your thinking? The burn in/monitor idea is a little more specific. . . .

[gringoloco2000]

Thanks. This would be very helpful.