I'm testing Snort in IDS mode and have been receiving a few (spp_sdf) SDF Combination Alerts as below. Seems like it happens when I visit certain but not all https sites.
Tried to google this alert but haven't had much success on what it means. Can this type of alert be ignored by adding it into suppression rules? Is this one of those false positives?
As far as I know, I'm not sending any sensitive data other than having a couple of secure sites left open logged on. Would that have been caused these alerts?