----- Original Message ----- > Just set the frequency to one, so it will catch after 3 events.... > > thanks, >
Sorry Daniel that does not work :( [root@hids01 ~]# grep -c "10044 matched" output.txt 3 [root@hids01 ~]# grep -c "10061 matched" output.txt 0 10061 is the correlated rule and it never fires. I have set the parameters as: <rule id="10061" level="10" frequency="1" timeframe="180"> <if_matched_sid>10044</if_matched_sid> <same_source_ip /> <description>Multiple SSHD authentication failures - GLPI #493</description> <group>authentication_failures,</group> </rule> Am I missing something still ? -- Thanks, Phil
