Hi,
I got another problem with this simple exemple
I got entry like that
10.0.0.1 login
10.0.0.2 login
10.0.0.1 login
10.0.0.6 login => Send a alert.
1.1.1.1 login2
2.2.2.2 login2 => do nothing.
etc...
I want to send a alert if a login is detected with 3 differents IP
in a windows of 1 hour.
I try with 3 SingleWithSuppress but i don't know how to link the
differents rules.
i am sure i will have to write a small perlfunc :(
Sorry for this (stupid ?) question,
Ludovic.
------------------------------------------------------------------------------
EditLive Enterprise is the world's most technically advanced content
authoring tool. Experience the power of Track Changes, Inline Image
Editing and ensure content is compliant with Accessibility Checking.
http://p.sf.net/sfu/ephox-dev2dev
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
