Re: [ossec-list] Timeout value units

2011-03-28 Thread dan (ddp)
The units are seconds. How far apart were the attacks? On Sun, Mar 27, 2011 at 12:31 PM, Steven Stern subscribed-li...@sterndata.com wrote: I just want to confirm In an active response rule, is the timeout value the number seconds? I had someone whacking my website today looking for mysql

[ossec-list] Timeout value units

2011-03-27 Thread Steven Stern
I just want to confirm In an active response rule, is the timeout value the number seconds? I had someone whacking my website today looking for mysql access and the rule triggered three times (on the same IP address) in two minutes. The first trigger should have locked out his IP for 360 --