----- Original Message -----
> I think your rule says that if you see 25 "5720 events" within 180
> seconds, fire rule 10044.
>
> This wouldn't stop 5720 from firing.
>
> What are you trying to do exactly?
>
> On Mon, Feb 7, 2011 at 6:06 AM, --[ UxBoD ]-- <[email protected]>
> wrote:
> > Require some help please with overriding a standard rule. I have
> > created the following in local_rules.xml:
> >
> > <rule id="10044" level="10" frequency="24" timeframe="180">
> > <if_matched_sid>5720</if_matched_sid>
> > <same_source_ip />
> > <description>Multiple SSHD authentication failures
> > (Local)</description>
> > <group>authentication_failures,</group>
> > </rule>
> >
> > but finding that 5720 is still hitting and this one never does. I
> > thought if the matched sid was referenced then a local rule would
> > take precedence ?
> >
> > --
> > Thanks, Phil
> >
>
Dan,
I think I see what I did wrong and have changed it now to use two rules:
<rule id="10044" level="0">
<if_sid>5720</if_sid>
<same_source_ip />
<description>Multiple SSHD authentication failures (Local)</description>
<group>authentication_failures,</group>
</rule>
<rule id="10044" level="10" frequency="24" timeframe="180">
if_matched_sid>10044</if_matched_sid>
<same_source_ip />
<description>Multiple SSHD authentication failures (Local)</description>
<group>authentication_failures,</group>
</rule>
So the first rule stops it from reporting and if that has been hit the second
correlates them again the frequency.
Is that the correct understanding ?
Thanks.
