[Snort-users] Thresholding issues

French, Jared jfrench539 at ...17128...
Thu Mar 26 17:08:58 EDT 2015


I'm fairly new to snort and I've been trying to get thresholding working,
but haven't had any luck.  Not with individual rules or global rules.   I
added the following line to to threshold.conf and ran a rule update after:

event_filter gen_id 0, sig_id 0, type limit, track by_src, count 1, seconds
360

However, when I open up snorby and watch the logs I'll get the same alert
popping up many times in row either with the same timestamp or well within
the given 360 seconds.  My understanding is that this line should cause any
and all rules to fire only once every 360 seconds.  Is that incorrect or is
something possibly broken?

The same happens when I try to apply thresholds for individual rules such
as:

event_filter gen_id 1, sig_id 2012252, type limit, track by_src, count 1,
seconds 360

which is the emerging theat SHELLCODE Common 0a0a0a0a Heap Spray String
alert.

Just looking for some help / clarifcation.  Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150326/91bfb0ee/attachment.html>


More information about the Snort-users mailing list