What is the difference between a blocking rule and a white rule?

Blocking a rule removes it from your rulebase so that it will have no effect.

Adding a white rule causes Sniffer to return a 0 result no matter what black rules may have fired.

If you feel that the black rule is more useful than harmful then it is often best to white rule the specific content you wish to clear. It is also better to add a white rule in cases where the content is likely to attract other black rule matches.

It is better to block a rule if it will cause you false positives consistently, if it conflicts with policies you have on your system, and if it is a direct match for the content you are trying to clear.

Related Topics