cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
403
Views
0
Helpful
1
Replies

confusion abt event count

sebastan_bach
Level 4
Level 4

hi all i have a confusion abt the event count value for the signatures.

say if i set the event count value to 5 then the signature will fire only if the event ocours 5 times right.

does it mean that when the first time the attack packet comes the signature is not fired and the action is not taken. the signature action is taken only if it hits 5 times.

is this what it means. and will the event be written to the event store.

can someone pls clarify this doubt.

regards

sebastan

1 Reply 1

s.jankowski
Level 4
Level 4

Event action rules are a group of settings you configure for the event action processing component of the sensor. These rules dictate the actions the sensor performs when an event occurs

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a00803eb027.html

Review Cisco Networking for a $25 gift card