SigEvent Action Filter

[darin.marais]

I have created a “SigEvent Action Filter” to filter all TCP syn host sweep (3030) from a single host to a defined variable "set of IP addresses". The filter appears to stop alerting on all of the events except the summarized alerts. These alerts are not filtered.

Is this knowen bug?

[a.giorgi]

Hi Darin:

I reproduced a similar scenario with signature 2004 (icmp request) that is sumarized by default and I dont get any event.

Probably is a bug of your version

I'm working with platform IDS-4215

Build version 5.0(1)S149.0

OS version 2.4.26-IDS-smp-bigphys

How about you?

Hope this helps (rate if it does)

Alberto Giorgi from spain