Snort mailing list archives
Thresholding issues
From: "French, Jared" <jfrench539 () g rwu edu>
Date: Thu, 26 Mar 2015 17:08:58 -0400
I'm fairly new to snort and I've been trying to get thresholding working, but haven't had any luck. Not with individual rules or global rules. I added the following line to to threshold.conf and ran a rule update after: event_filter gen_id 0, sig_id 0, type limit, track by_src, count 1, seconds 360 However, when I open up snorby and watch the logs I'll get the same alert popping up many times in row either with the same timestamp or well within the given 360 seconds. My understanding is that this line should cause any and all rules to fire only once every 360 seconds. Is that incorrect or is something possibly broken? The same happens when I try to apply thresholds for individual rules such as: event_filter gen_id 1, sig_id 2012252, type limit, track by_src, count 1, seconds 360 which is the emerging theat SHELLCODE Common 0a0a0a0a Heap Spray String alert. Just looking for some help / clarifcation. Thanks!
------------------------------------------------------------------------------ Dive into the World of Parallel Programming The Go Parallel Website, sponsored by Intel and developed in partnership with Slashdot Media, is your hub for all things parallel software development, from weekly thought leadership blogs to news, videos, case studies, tutorials and more. Take a look and join the conversation now. http://goparallel.sourceforge.net/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Thresholding issues French, Jared (Mar 26)
- Re: Thresholding issues James Lay (Mar 26)