David and John, thanks for your help.
I've tried both solutions and both works as expected.
The eventgroup rule provided works fine, I've tested it ok.
I haven't thought it before, but you were right about to trigger the rule
whatever the events order comes in.
Eventgroup fits perfectly to do that.
Jose.
---- On Wed, 05 Sep 2012 19:10:57 -0700 John P. Rouillard
<[email protected]> wrote ----
In message <[email protected]>,
"John P. Rouillard" writes:
>However this is an odd set of rules. What are you trying to do? Just
>determine if event 1 and event 2 occur within 10 seconds of each other
>regardless of the order in which they arrive? If so see
>...
I forgot to mention that the EventGroup rule (in SEC version 2.6.2)
should also be able to do this order independent correlation much more
directly than the method in the paper above. I think the following
(untested and I am not as familiar with the EventGoup rule as I would
like) should work:
type = EventGroup2
ptype = regexp
pattern = Link down on interface FastEthernet and ip 10.10.10.10
ptype2 = regexp
pattern2 = Ospf on device 10.10.10.10 has changed neighbor 11.11.11.11
desc = detect pattern and pattern2 arriving in any order within 10 seconds
action = write - say event1 and event2 in 10 seconds
window = 10
If I am wrong hopefully somebody will correct this.
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
