Re: Noisy Rules

[Mark.Schutzmann () Omron com]

Paul,

Try this as an example:

alert icmp $HOME_NET any -> any any (msg: "ALERT!!! Welchia Infection!!!
(Each Event=500)"; content: "|aaaa aaaa aaaa aaaa aaaa aaaa
 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa
aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa|"; dsi
ze:64; itype: 8; icode: 0; threshold: type limit, track by_src, count 500,
seconds 300; classtype:trojan-activity; sid: 100000507; r
ev: 2;)

( I guess for the rest, you can use it to test your alerting... ;-)  )

Regards,
Mark


                                                                                                                        
                          
                      "Paul Lane"                                                                                       
                          
                      <paul_lane () supplyworks com>         To:       <snort-users () lists sourceforge net>           
                                
                      Sent by:                            cc:                                                           
                          
                      snort-users-admin () lists sour        Subject:  [Snort-users] Noisy Rules                        
                             
                      ceforge.net                                                                                       
                          
                                                                                                                        
                          
                                                                                                                        
                          
                      03/04/2004 11:10 AM                                                                               
                          
                                                                                                                        
                          
                                                                                                                        
                          





I'm running Snort 2.1 with MSSQL, Acid and IIS on Windows 2003 server.
I have some rules that are chatty, but I want to keep them.
How do I set a limit to the number of notifications it will send me per
hour?

Thanks,

Paul Lane






-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users