On Fri, Jul 7, 2017 at 8:07 AM, chintan shah <[email protected]> wrote: > Hi Guys , > > Just wanted to check if anybody has an idea on how to throttle the events in > OSSEC . I have a situation where there are 20 duplicate alerts within a > second and I would want to raise only 1 alert for that . Is there any event > throttling mechanism in OSSEC where only 1 event can be raised for the N > number of events within a timeframe ? >
Look at the frequency and timeframe rule options. > Regads > Chintan > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
