Require some help please with overriding a standard rule. I have created the
following in local_rules.xml:
<rule id="10044" level="10" frequency="24" timeframe="180">
<if_matched_sid>5720</if_matched_sid>
<same_source_ip />
<description>Multiple SSHD authentication failures (Local)</description>
<group>authentication_failures,</group>
</rule>
but finding that 5720 is still hitting and this one never does. I thought if
the matched sid was referenced then a local rule would take precedence ?
--
Thanks, Phil
