services.suricata.settings.exception-policy

Define a common behavior for all exception policies. In IPS mode, the default is drop-flow. For cases when that's not possible, the engine will fall to drop-packet. To fallback to old behavior (setting each of them individually, or ignoring all), set this to ignore. All values available for exception policies can be used, and there is one extra option: auto - which means drop-flow or drop-packet (as explained above) in IPS mode, and ignore in IDS mode. Exception policy values are: drop-packet, drop-flow, reject, bypass, pass-packet, pass-flow, ignore (disable).