I have a question concerning the creation of "custom" event such as "User Defined"and "Connection" type events. If a single packet matches criteria for and XPU signature, and a user defined event, and a connection event what will it be displayed as in the Sensor Analysis tab. Will only 1 of those be selected based on some order of processing or will it show up 3 times. My concern is that writing broad type of connection event might mask more serious events if they only display 1 time.
Regards, Chris Norris American Modern Insurance Companies Sr. Security Engineer IS Risk and Security Management 7000 Midland Blvd. Amelia, OH 45102 Ph: 513-947-5454 email: [EMAIL PROTECTED] _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
