Easier to add exclusions

[runesyd]

I miss the opportunity to add exclusions an easier way. E.g based on the flow output. So when I click an IP-address in the output it should also include "Add to exclusions as Source/Destination IP". (together with "Add to query as Source IP"++)

[runesyd]

This could probably be solved best in combination with IPsets. So you can easily add IP-addresses to an IPset which you exclude. (--not-[sd]ipset)

[automayt]

I'll leave this open as a feature request. Fundamentally, SiLK works be using the output parameter --fail to "fail" out things that rwfilter takes from stdout. FlowBAT specifically appends these to the end of a query as something like rwfilter --input-pipe=stdin --proto=17 --site-config-file=/data/silk.conf --fail=stdout to fail out protocol 17. It isn't a trivial thing to add to the UI, but it also isn't impossible.