Hi Phil, On Tue, Feb 8, 2011 at 7:23 AM, --[ UxBoD ]-- <[email protected]> wrote: > Dan, > > I think I see what I did wrong and have changed it now to use two rules: > > <rule id="10044" level="0"> > <if_sid>5720</if_sid> > <same_source_ip /> > <description>Multiple SSHD authentication failures (Local)</description> > <group>authentication_failures,</group> > </rule> >
You don't need the same_source_ip option. That only really matters when you're looking for multiple events from the same IP. You may need to raise the level to 1, I don't know. I've never tried this with a level 0 event. > <rule id="10044" level="10" frequency="24" timeframe="180"> > if_matched_sid>10044</if_matched_sid> > <same_source_ip /> > <description>Multiple SSHD authentication failures (Local)</description> > <group>authentication_failures,</group> > </rule> > You duplicated the rule id, this one should be 10045. Other than that it looks good. > So the first rule stops it from reporting and if that has been hit the second > correlates them again the frequency. > > Is that the correct understanding ? > > Thanks. > That looks correct to me.
