----- Original Message -----
> I think your rule says that if you see 25 "5720 events" within 180
> seconds, fire rule 10044.
>
> This wouldn't stop 5720 from firing.
>
> What are you trying to do exactly?
>
> On Mon, Feb 7, 2011 at 6:06 AM, --[ UxBoD ]-- <[email protected]>
> wrote:
> > Require some help please with overriding a standard rule. I have
> > created the following in local_rules.xml:
> >
> > <rule id="10044" level="10" frequency="24" timeframe="180">
> > <if_matched_sid>5720</if_matched_sid>
> > <same_source_ip />
> > <description>Multiple SSHD authentication failures
> > (Local)</description>
> > <group>authentication_failures,</group>
> > </rule>
> >
> > but finding that 5720 is still hitting and this one never does. I
> > thought if the matched sid was referenced then a local rule would
> > take precedence ?
> >
> > --
> > Thanks, Phil
> >
>
Argh, okay. What we want is exactly that; to see that rule when it hits 25
events within 180 seconds but at the same time disable rule 5720 from firing :)
