----- Original Message -----
> Hi Phil,
>
> On Tue, Feb 8, 2011 at 7:23 AM, --[ UxBoD ]-- <[email protected]>
> wrote:
> > Dan,
> >
> > I think I see what I did wrong and have changed it now to use two
> > rules:
> >
> > <rule id="10044" level="0">
> > <if_sid>5720</if_sid>
> > <same_source_ip />
> > <description>Multiple SSHD authentication failures
> > (Local)</description>
> > <group>authentication_failures,</group>
> > </rule>
> >
>
> You don't need the same_source_ip option. That only really matters
> when you're looking for multiple events from the same IP.
> You may need to raise the level to 1, I don't know. I've never tried
> this with a level 0 event.
>
> > <rule id="10044" level="10" frequency="24" timeframe="180">
> > if_matched_sid>10044</if_matched_sid>
> > <same_source_ip />
> > <description>Multiple SSHD authentication failures
> > (Local)</description>
> > <group>authentication_failures,</group>
> > </rule>
> >
>
> You duplicated the rule id, this one should be 10045. Other than that
> it looks good.
>
> > So the first rule stops it from reporting and if that has been hit
> > the second correlates them again the frequency.
> >
> > Is that the correct understanding ?
> >
> > Thanks.
> >
>
> That looks correct to me.
>
Thanks Dan. Yeah I copied and pasted my thoughts hence the rule id dupe :) Are
okay so for the first rule I remove same_source_ip and then use it in the
correlated rule. That makes perfect sense.
