[Snort-users] [sonrt-user]About rule options

Mayur Patil ram.nath241089 at ...11827...
Tue Sep 24 07:11:06 EDT 2013


Hi,

    I want to ask which is the alternate option to use in  shared object
rule

    instead of

***     *threshold*

**     detection_filter
*
*
*     track_by*

**     event_filter*

as these options become obsolete when parsing the text rules

and I want to use  *counts,seconds*    which are parts of above options.

is there any alternative or replacement??

Seeking for guidance,

Thanks !!

-- 
*Cheers,
Mayur*.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130924/eda15c63/attachment.html>


More information about the Snort-users mailing list