I am trying to alert after 3 anonymous logins. I have it working with only 1 login, but as soon as I change it to alert after 3 it doesn't see it. At the moment I have a custom string.tcp signature with all the defaults except the number of minhits was changed to three. I've experimented with several changes, but it still doesn't work. Anyone know what I am missing?
