Modify.conf possibly not working, probably a newbie error?

No problems, I hope it helps. :slight_smile:

Maybe these could offer some clarity:

Oh, I just saw this answer that is about pass rules, too: In Suricata IDS mode. is it possible to block/drop/pass good traffic so it will not be seen in kibana? - #15 by sscally

Good luck with your learning journey!