Re: [OSL | CCIE_Security] IPS custom signature, weird problem

2013-11-12 Thread jeremy co
Piotr, That explains what I see. Thanks for your veryhelpful explanation. On Mon, Nov 11, 2013 at 11:24 PM, Piotr Kaluzny pio...@ipexpert.com wrote: With the Summary Mode set to Summarize (what you did), you will always see a first alert for the Attacker and then at the end of the interval a

Re: [OSL | CCIE_Security] IPS custom signature, weird problem

2013-11-11 Thread Piotr Kaluzny
With the Summary Mode set to Summarize (what you did), you will always see a first alert for the Attacker and then at the end of the interval a so-called Summary which is a collective-like log for all events seen generated based on *Summary Key*. Since your Summary Key is Attacker, it means that