title: Redirect user that tries to view malicious URL or one that is not on the snort rule list?
body: <p>I have a fairly simple inline IPS set up that is using Snort as the detection system. I was wondering if it is possible with Snort to redirect a user that tries to view a URL that is on a disallowed list. </p>
  
  <p>I'm subscribed to the Snort live-updated/most recent database and it is working and giving me alerts, but the only thing I have seen so far on the topic of redirections is to go:</p>
  
  <p>Malicious attack -> Snort recognizes attack -> redirected to honeypot, and not:</p>
  
  <p>User on LAN -> snort recognized disallowed site -> redirects to xyz page</p>