[sniffer] FPs on Sniffer-Schemes

2012-03-12 Thread Darin Cox
Hi Pete, We're seeing a ton of FPs on a Sniffer-Schemes rule # 4764784. Darin.

[sniffer] Re: FPs on Sniffer-Schemes

2012-03-12 Thread Darin Cox
More info... Started getting hits at 4:30pm EST up to 15 minutes ago (5:25pm EST). Not sure if the rule has been pulled or corrected yet. Had 383 hits, and a very high percentage of those were FPs. Don't have an exact number, due to having to release the messages quickly for delivery, but I

[sniffer] Re: FPs on Sniffer-Schemes

2012-03-12 Thread Pete McNeil
On 3/12/2012 5:17 PM, Darin Cox wrote: Hi Pete, We're seeing a ton of FPs on a Sniffer-Schemes rule # 4764784. That rule was detected as an error and removed almost immediately after it was created. You should

[sniffer] Re: FPs on Sniffer-Schemes

2012-03-12 Thread Pete McNeil
On 3/12/2012 5:41 PM, Darin Cox wrote: Started getting hits at 4:30pm EST up to 15 minutes ago (5:25pm EST). Not sure if the rule has been pulled or corrected yet. It was corrected nearly as soon as it was created. It did escape into some rulebases - we saw

[sniffer] Re: FPs on Sniffer-Schemes

2012-03-12 Thread Pete McNeil
On 3/12/2012 5:41 PM, Darin Cox wrote: Started getting hits at 4:30pm EST up to 15 minutes ago (5:25pm EST). I think I can see part of the problem (possibly). I do not have telemetry from your system (based on looking up your Id from your domain). I suspect this