----- Original Message ----- > > ----- Original Message ----- > > On Wed, Feb 23, 2011 at 11:10 AM, --[ UxBoD ]-- > > <[email protected]> > > wrote: > > > ----- Original Message ----- > > >> Just set the frequency to one, so it will catch after 3 > > >> events.... > > >> > > >> thanks, > > >> > > > > > > Sorry Daniel that does not work :( > > > > > > [root@hids01 ~]# grep -c "10044 matched" output.txt > > > 3 > > > [root@hids01 ~]# grep -c "10061 matched" output.txt > > > 0 > > > > > > 10061 is the correlated rule and it never fires. I have set the > > > parameters as: > > > > > > <rule id="10061" level="10" frequency="1" timeframe="180"> > > > <if_matched_sid>10044</if_matched_sid> > > > <same_source_ip /> > > > <description>Multiple SSHD authentication failures - GLPI > > > #493</description> > > > <group>authentication_failures,</group> > > > </rule> > > > > > > Am I missing something still ? > > > > > > -- > > > Thanks, Phil > > > > > > > What happens if 10044 is triggered 4 times in 180 seconds? > > > > I'm guessing frequency rules that watch frequency rules isn't going > > to > > work well. > > dan > > > > Why ? I cannot see why compound rules should not work as > ossec-logtest appears to parse them okay. Rule 10044 is there to > suppress a default role: > > <rule id="10044" level="1"> > <if_sid>5551</if_sid> > <description>Multiple SSHD authentication failures (Override > Generic)</description> > <group>authentication_failures,</group> > </rule> > > that triggers three times so why would 10061 not trigger if the > frequency has been set to 1 as Daniel (CID) mentioned ? >
Any thoughts on this as it does not appear to be working as described ? -- Thanks, Phil
