Hello,
I currently have a rule set to show me when people successfully login to
some of my servers, and I was wondering if there was an easy way to
group this? For example If I had one user log in twenty times within one
hour I will get twenty separate messages. Is there a way that I can
group all of the successful messages for one user into one message every
hour or something? Here is my current rule.
<rule id="100023" level="3">
<if_group>authentication_success</if_group>
<options>alert_by_email</options>
<description>Yay, someone logged in, and here's an alert.</description>
</rule>
<rule id="100024" level="3">
<if_sid>100023</if_sid>
<match>session</match>
<description>Don't show session opened</description>
</rule>
<rule id="100025" level="3">
<if_sid>100023</if_sid>
<hostname>logon|linuxdev|therm5</hostname>
<description>Don't show hosts's that we don't want to see.</description>
</rule>
Thanks, Jonny
