----- Original Message -----
> On Wed, Feb 23, 2011 at 11:10 AM, --[ UxBoD ]-- <[email protected]>
> wrote:
> > ----- Original Message -----
> >> Just set the frequency to one, so it will catch after 3 events....
> >>
> >> thanks,
> >>
> >
> > Sorry Daniel that does not work :(
> >
> > [root@hids01 ~]# grep -c "10044 matched" output.txt
> > 3
> > [root@hids01 ~]# grep -c "10061 matched" output.txt
> > 0
> >
> > 10061 is the correlated rule and it never fires. I have set the
> > parameters as:
> >
> > <rule id="10061" level="10" frequency="1" timeframe="180">
> > <if_matched_sid>10044</if_matched_sid>
> > <same_source_ip />
> > <description>Multiple SSHD authentication failures - GLPI
> > #493</description>
> > <group>authentication_failures,</group>
> > </rule>
> >
> > Am I missing something still ?
> >
> > --
> > Thanks, Phil
> >
>
> What happens if 10044 is triggered 4 times in 180 seconds?
>
> I'm guessing frequency rules that watch frequency rules isn't going
> to
> work well.
> dan
>
Why ? I cannot see why compound rules should not work as ossec-logtest appears
to parse them okay. Rule 10044 is there to suppress a default role:
<rule id="10044" level="1">
<if_sid>5551</if_sid>
<description>Multiple SSHD authentication failures (Override
Generic)</description>
<group>authentication_failures,</group>
</rule>
that triggers three times so why would 10061 not trigger if the frequency has
been set to 1 as Daniel (CID) mentioned ?
--
Thanks, Phil
