I think your rule says that if you see 25 "5720 events" within 180 seconds, fire rule 10044.
This wouldn't stop 5720 from firing. What are you trying to do exactly? On Mon, Feb 7, 2011 at 6:06 AM, --[ UxBoD ]-- <[email protected]> wrote: > Require some help please with overriding a standard rule. I have created the > following in local_rules.xml: > > <rule id="10044" level="10" frequency="24" timeframe="180"> > <if_matched_sid>5720</if_matched_sid> > <same_source_ip /> > <description>Multiple SSHD authentication failures (Local)</description> > <group>authentication_failures,</group> > </rule> > > but finding that 5720 is still hitting and this one never does. I thought if > the matched sid was referenced then a local rule would take precedence ? > > -- > Thanks, Phil >
