On 05/24/2012 02:42 PM, Richard Jones wrote: > Hi All, > > I have a question. From the man page: > > The SingleWithThreshold rule runs event correlation operations for > counting repeated instances of the same event during T seconds, and > taking an action if N events are observed. > > Is there any way to get hold of the value of N? > > I would like the sliding window value, not the absolute value.
Actually, the window of SingleWithThreshold *is* sliding -- if the threshold N is not reached after T seconds, the window moves forward, leaving the first event outside the window and decrementing the event counter. However, if you would like to change threshold N during counting operations, you would need to implement counting with custom Perl data structures connected to Single rules. kind regards, risto > > Thanks, > > Richard > ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
