I'm testing Snort in IDS mode and have been receiving a few (spp_sdf) SDF Combination Alerts as below. Seems like it happens when I visit certain but not all https sites.

Tried to google this alert but haven't had much success on what it means. Can this type of alert be ignored by adding it into suppression rules? Is this one of those false positives?

As far as I know, I'm not sending any sensitive data other than having a couple of secure sites left open logged on. Would that have been caused these alerts?

Snort alert image

1 Answer 1


This is when Snort detect some kind of sensitive data (email or social security number).

The Sensitive Data preprocessor is a Snort module that performs detection and filtering of Personally Identifiable Information (PII). This information includes credit card numbers, U.S. Social Security numbers, and email addresses. A limited regular expression syntax is also included for defining your own PII.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .