On Tue, Mar 22, 2011 at 7:20 AM, --[ UxBoD ]-- <[email protected]> wrote: >> Why ? I cannot see why compound rules should not work as >> ossec-logtest appears to parse them okay. Rule 10044 is there to >> suppress a default role: >> >> <rule id="10044" level="1"> >> <if_sid>5551</if_sid> >> <description>Multiple SSHD authentication failures (Override >> Generic)</description> >> <group>authentication_failures,</group> >> </rule> >> >> that triggers three times so why would 10061 not trigger if the >> frequency has been set to 1 as Daniel (CID) mentioned ? >> > > Any thoughts on this as it does not appear to be working as described ? > -- > Thanks, Phil
What happens if 10044 is triggered 4 times?
