Can anyone explain what the level is used for here? Is there a list of what the different levels actually change or do?
I am trying to make adjustments and to the eve log and reduce some of the noise. I know that there are sections for -alerts and more below this section but I am trying to understand what level is used for.
- eve-log:
enabled: yes
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve.json
# Enable for multi-threaded eve.json output; output files are amended
# with an identifier, e.g., eve.9.json
#threaded: false
#prefix: "@cee: " # prefix to prepend to each log entry
# the following are valid when type: syslog above
#identity: “suricata”
#facility: local5
#level: Info ## possible levels: Emergency, Alert, Critical,
## Error, Warning, Notice, Info, Debug