In message <[email protected]>,
"John P. Rouillard" writes:
>However this is an odd set of rules. What are you trying to do? Just
>determine if event 1 and event 2 occur within 10 seconds of each other
>regardless of the order in which they arrive? If so see
>...
I forgot to mention that the EventGroup rule (in SEC version 2.6.2)
should also be able to do this order independent correlation much more
directly than the method in the paper above. I think the following
(untested and I am not as familiar with the EventGoup rule as I would
like) should work:
type = EventGroup2
ptype = regexp
pattern = Link down on interface FastEthernet and ip 10.10.10.10
ptype2 = regexp
pattern2 = Ospf on device 10.10.10.10 has changed neighbor 11.11.11.11
desc = detect pattern and pattern2 arriving in any order within 10 seconds
action = write - say event1 and event2 in 10 seconds
window = 10
If I am wrong hopefully somebody will correct this.
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
