With rules is there a way to say if a logon within a time frame does not come from the same source IP then raise an alert? I'd also like to create an alert for multiple users logging in from the same source IP. So I'm looking for a way of doing (!<same_source_ip /> and <same_user />) and (<same_source_ip /> and !<same_user />) .
-- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
