topic fire once summary mode question in Network Security

fire once summary mode question

mhellman — Sun, 10 Mar 2019 10:05:15 GMT

let's say I have signature with the following characteristics:

Event Counter

-------------

Event Count: 1

Event Count Key: Attacker and Victim addresses

Specifiy Alert Interval: No

Alert Frequency

---------------

Summary Mode: Fire Once

Summary Key: attacker and victim addresses

Specify Global Summary Threshold: No

Obviously, it will alarm for the first event, but what about subsequent events? Testing reveals that it does eventually generate more alarms...but how much time much pass?

Re: fire once summary mode question

craig.lepchenske — Sun, 09 Jul 2006 07:35:25 GMT

The amount of time is indicated by the Summary Interval (Time in seconds used in each summary alert).

I think by default, signatures are set to 15 seconds.

Re: fire once summary mode question

mhellman — Mon, 10 Jul 2006 14:53:13 GMT

AFAICT, there is no summary interval for the "fire once" summary mode. It is not exposed to the user for viewing/modification anyway. 15 seconds doesn't seem likely given the testing I did. It was ~2 minutes that a new alarm would fire.