Re: Notification limitation

[Jaime Nebrera <jnebrera () gmail com>]

I'm aware of this, I just don't know were to put such configuration :)

Enviado desde mi iPhone

El 13/01/2012, a las 19:16, CleBeer <clebeer () gmail com> escribió:

Hi,
you can use this option in you snort.conf

-----
 event_filter \
        gen_id 0, sig_id 0, \
        type both, track by_src, \
        count 6, seconds 600
----

Take a look in the README.filters at snort source for more examples.


cheers

On Thu, Jan 12, 2012 at 8:20 AM, Jaime Nebrera <jnebrera () gmail com> wrote:

>   Hi all,
>
>   Im aware this is a basic question but Im a bit lost.
>
>   I would like to limit the number of alarms sent to a Snorby system in
> a general way (not specific to a particular rule).
>
>   Something like this:
>
>   For a particular event send no more than 3 per minute AND 6 per 5 minutes
>
>   I want to apply this limit to ALL rules and events, thus wont get
> flooded by the same event many times in the same timeframe
>
>   Of course this doesnt mean more events can reach the snorby box, but
> they will be different rules, not the same
>
>   My I ask how to do this?
>
>
> ------------------------------------------------------------------------------
> RSA(R) Conference 2012
> Mar 27 - Feb 2
> Save $400 by Jan. 27
> Register now!
> http://p.sf.net/sfu/rsa-sfdev2dev2
> _______________________________________________
> Snort-devel mailing list
> Snort-devel () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!



-- 
-----------------------------
Cleber S. Brandão
Mob. +55 11 9333-9429

clebeerpub.blogspot.com
www.snort.org.br
  ,, _
 o"    )~
   '' ''
http://www.linkedin.com/in/clebeer
-----------------------------------

------------------------------------------------------------------------------
RSA(R) Conference 2012
Mar 27 - Feb 2
Save $400 by Jan. 27
Register now!
http://p.sf.net/sfu/rsa-sfdev2dev2

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!