fire once summary mode question

[mhellman]

let's say I have signature with the following characteristics:

Event Counter

-------------

Event Count: 1

Event Count Key: Attacker and Victim addresses

Specifiy Alert Interval: No

Alert Frequency

---------------

Summary Mode: Fire Once

Summary Key: attacker and victim addresses

Specify Global Summary Threshold: No

Obviously, it will alarm for the first event, but what about subsequent events? Testing reveals that it does eventually generate more alarms...but how much time much pass?

[craig.lepchenske]

The amount of time is indicated by the Summary Interval (Time in seconds used in each summary alert).

I think by default, signatures are set to 15 seconds.

[mhellman]

AFAICT, there is no summary interval for the "fire once" summary mode. It is not exposed to the user for viewing/modification anyway. 15 seconds doesn't seem likely given the testing I did. It was ~2 minutes that a new alarm would fire.