confusion abt event count

[sebastan_bach]

hi all i have a confusion abt the event count value for the signatures.

say if i set the event count value to 5 then the signature will fire only if the event ocours 5 times right.

does it mean that when the first time the attack packet comes the signature is not fired and the action is not taken. the signature action is taken only if it hits 5 times.

is this what it means. and will the event be written to the event store.

can someone pls clarify this doubt.

regards

sebastan

[s.jankowski]

Event action rules are a group of settings you configure for the event action processing component of the sensor. These rules dictate the actions the sensor performs when an event occurs

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a00803eb027.html