Check the global response, it will allow you to set thresholds and send mails based on it.
hic sonni wrote: >Hi All, > >Is it possible to raise toe severity (from Medium to >Height) of an event if it occurs more that a defined >threshold? I want to do it for POP3_Auth_Failed if it >occurs from one SOURCE more that 5 time peer minute >or….. > >If I can send Response mail only for that event (which > exceed the thershold )it will be much better ?? > >In reality, we have an Exchange Server, and we’ve a >lot of POP3_Auth_Failed from Insider and also from >outsider, we want to do this for outsider who try to >do a dictionary attach against POP3, by arising the >severity we can distinguish between normal and anormal >Authentication Failed . >Hope I was clear! > >Best Regards > > >Thanks >Hic Sonni > > > > >__________________________________ >Yahoo! Mail - PC Magazine Editors' Choice 2005 >http://mail.yahoo.com > > >_______________________________________________ >ISSForum mailing list >[email protected] > >TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to >https://atla-mm1.iss.net/mailman/listinfo/issforum > >To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] > >The ISSForum mailing list is hosted and managed by Internet Security Systems, >6303 Barfield Road, Atlanta, Georgia, USA 30328. > > -- Andrés Riancho http://www.securearg.net/ Secure from the Source _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
