I just want to confirm.... In an active response rule, is the timeout value the number seconds?
I had someone whacking my website today looking for mysql access and the rule triggered three times (on the same IP address) in two minutes. The first trigger should have locked out his IP for "360" -- my assumption is that is 6 minutes, long enough for the script to time out and move on to someone else. -- -- Steve
