topic event summarization in Network Security https://community.cisco.com/t5/network-security/event-summarization/m-p/458953#M90677 <P>I've noticed summary alerts without a preceding non-summarized alert, which I thought was impossible.</P><P></P><P>Are signatures using a summary mode of "summarize" always supposed to generate 2 alerts, the initial alert that starts the counter and then a summarized alert?</P><P></P><P>The only explanation I can think of is the event filters. Is it possible that an event filter [especially one with "stop on match" disabled] would prevent the initial alert but not the summarized alert?</P> Sun, 10 Mar 2019 09:50:56 GMT mhellman 2019-03-10T09:50:56Z event summarization https://community.cisco.com/t5/network-security/event-summarization/m-p/458953#M90677 <P>I've noticed summary alerts without a preceding non-summarized alert, which I thought was impossible.</P><P></P><P>Are signatures using a summary mode of "summarize" always supposed to generate 2 alerts, the initial alert that starts the counter and then a summarized alert?</P><P></P><P>The only explanation I can think of is the event filters. Is it possible that an event filter [especially one with "stop on match" disabled] would prevent the initial alert but not the summarized alert?</P> Sun, 10 Mar 2019 09:50:56 GMT https://community.cisco.com/t5/network-security/event-summarization/m-p/458953#M90677 mhellman 2019-03-10T09:50:56Z Re: event summarization https://community.cisco.com/t5/network-security/event-summarization/m-p/458954#M90678 <HTML><HEAD></HEAD><BODY><P>That looks strange to me too. Summary alarms gets triggered at the end of the throttle-interval. If summarization is configured for a signature, then the first alarm is sent when it occurs and all other alarms are blocked and only a summary alram is sent at the end of the throttle interval. </P><P></P><P><A class="jive-link-custom" href="http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/idmiev/swappa.htm#wp787013" target="_blank">http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/idmiev/swappa.htm#wp787013</A></P><P></P><P></P></BODY></HTML> Tue, 24 Jan 2006 16:16:00 GMT https://community.cisco.com/t5/network-security/event-summarization/m-p/458954#M90678 ebreniz 2006-01-24T16:16:00Z