----- Original Message ----- > Hey, > > The frequency of 6, actually means 8 events for it to alert. It makes > sense when you think of the rule in these terms: > > if_matched_sid -> Alert me if the rule XYZ fired in the last ABC > seconds more than 6 times (not including the current event). > > So in your case, the rule 5551 will check if in the last few minutes > the rule 5503 was set more than 6 times... So out of the 31 > events, you would get 3 alerts from the rule 5551. > > So why is that? Because you can write rules like this one: > > <if_group>authentication_success</if_group> > <if_matched_group>authentication_failure</if_matched_group> > > So the current event is not tied to the list when searching on the > if_matched_* signatures.... > > Hope it made some sense :) > > Thanks, >
Hi Daniel, Thank you very much for taking the time to respond it is appreciated. Would it not be 7 events then ? If 6 had come through, and one discards the current, then you would be alerting on the seventh. Long day so trying to get my head around the logic :) Thanks, P.
