On Wed, Feb 23, 2011 at 11:10 AM, --[ UxBoD ]-- <[email protected]> wrote: > ----- Original Message ----- >> Just set the frequency to one, so it will catch after 3 events.... >> >> thanks, >> > > Sorry Daniel that does not work :( > > [root@hids01 ~]# grep -c "10044 matched" output.txt > 3 > [root@hids01 ~]# grep -c "10061 matched" output.txt > 0 > > 10061 is the correlated rule and it never fires. I have set the parameters as: > > <rule id="10061" level="10" frequency="1" timeframe="180"> > <if_matched_sid>10044</if_matched_sid> > <same_source_ip /> > <description>Multiple SSHD authentication failures - GLPI #493</description> > <group>authentication_failures,</group> > </rule> > > Am I missing something still ? > > -- > Thanks, Phil >
What happens if 10044 is triggered 4 times in 180 seconds? I'm guessing frequency rules that watch frequency rules isn't going to work well. dan
