# Suricata drop/ Alerts to external Database

**URL:** <https://forum.suricata.io/t/suricata-drop-alerts-to-external-database/2028>\
**Category:** Help\
**Created:** [December 16, 2021, 7:57am UTC](https://forum.suricata.io/t/suricata-drop-alerts-to-external-database/2028 "2021-12-16T07:57:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ashokdev7](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ashokdev7/32/1143_2.png) [@ashokdev7](https://forum.suricata.io/u/ashokdev7)\
**Post date:** [December 16, 2021, 7:57am UTC](https://forum.suricata.io/t/suricata-drop-alerts-to-external-database/2028/1 "2021-12-16T07:57:21Z")

</div>

Hi All ,  
I have few doubts if you can help it will be nice

1. Many rules have action : alert , so is the traffic allowed by just alerting ? .
2. If I want to send alert , drop this malicious traffic to a external database for further analysis how can I do that.

---

<div class="post-metadata">

**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\
**Post date:** [December 16, 2021, 10:02am UTC](https://forum.suricata.io/t/suricata-drop-alerts-to-external-database/2028/2 "2021-12-16T10:02:21Z")

</div>

Hi!

1. If you are running Suricata in IDS mode, it will generate alerts based on rules, but won’t drop the traffic (if you want malicious traffic to be dropped, consider the IPS mode - but that depends on the network setup you have, to really work);
2. If you want to capture the malicious traffic if certain alerts happen, the released Suricata versions don’t have that capability as of yet. But Conditional PCAP logging is one of the new features for Suricata 7, which should be released within a few months.

Mr Éric Leblond is the contributor for this addition. See his presentation during SuriCon2021:

- [Presentation video](https://youtu.be/f06SW5yaGLY) ([New for Suricata 7: Conditional PCAP - YouTube](https://youtu.be/f06SW5yaGLY))
- [Related blog article](https://www.stamus-networks.com/blog/coming-soon-in-suricata-7-conditional-pcap-suricon?hsLang=en)([Coming Soon in Suricata 7: Conditional PCAP @ Suricon](https://www.stamus-networks.com/blog/coming-soon-in-suricata-7-conditional-pcap-suricon))

---

<div class="post-metadata">

**Author:** ![ashokdev7](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ashokdev7/32/1143_2.png) [@ashokdev7](https://forum.suricata.io/u/ashokdev7)\
**Post date:** [December 16, 2021, 5:57pm UTC](https://forum.suricata.io/t/suricata-drop-alerts-to-external-database/2028/3 "2021-12-16T17:57:42Z")

</div>

Hi , Got it thanks .  
Just to make sure section 13 in read the docs is sufficient for IPS setting ?

---

<div class="post-metadata">

**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\
**Post date:** [December 16, 2021, 6:04pm UTC](https://forum.suricata.io/t/suricata-drop-alerts-to-external-database/2028/4 "2021-12-16T18:04:34Z")

</div>

I’m not an expert in that regard, so can’t help there 😛

But if you encounter any issues, as you know, this forum is your friend ^^