Re: [ossec-list] another AR question..

2011-12-25 Thread dan (ddp)
There's nothing that will do this. You could build the intelligence
into the AR script itself.

On Fri, Dec 23, 2011 at 9:42 PM, Kat uncommon...@gmail.com wrote:
 Just wondering if there is a simple way that saying in a 5 minute
 period - an alert triggers an active response 20 times, I only want
 the AR to activate ONCE? I know how to set counters on the alert, but
 I don't want to do that. I want the alert to keep logging - but I
 don't want the response to run 20 times if the alert triggers.

 Thoughts? Comments

 Thanks


[ossec-list] another AR question..

2011-12-23 Thread Kat
Just wondering if there is a simple way that saying in a 5 minute
period - an alert triggers an active response 20 times, I only want
the AR to activate ONCE? I know how to set counters on the alert, but
I don't want to do that. I want the alert to keep logging - but I
don't want the response to run 20 times if the alert triggers.

Thoughts? Comments

Thanks