On Fri, Jul 7, 2017 at 8:07 AM, chintan shah <shahchint...@gmail.com> wrote: > Hi Guys , > > Just wanted to check if anybody has an idea on how to throttle the events in > OSSEC . I have a situation where there are 20 duplicate alerts within a > second and I would want to raise only 1 alert for that . Is there any event > throttling mechanism in OSSEC where only 1 event can be raised for the N > number of events within a timeframe ? >
Look at the frequency and timeframe rule options. > Regads > Chintan > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.