cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1358
Views
0
Helpful
3
Replies

Query regarding Rules in MARS

rashidsiddiqui
Beginner
Beginner

Hello Friends,

Please let me know what type of Event these rules will trigger? (REFER ATTACHED DOC SCREENSHOT)

Specifically I want to know the meaning behind “Count”. If I increase the count field to 2 or 3 what will it do.

Also the time I configured is 10 minutes. Is it like it will check the condition for a time period of 10 minutes? What is the significance of time field here?

1 Accepted Solution

Accepted Solutions

praprama
Cisco Employee
Cisco Employee

Hi,

Was just wondering if the query is resolved. if so, please mark this as answered

Thanks and Regards,

Prapanch

View solution in original post

3 Replies 3

praprama
Cisco Employee
Cisco Employee

Hi Rashid,

The below link should give the description of each of the fields:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/user/guide/combo/rules.html#wp532081

The field "Count" refers to the number of times the event in the "Event" field has to fire within the "Time Range" specified for this Rule for the condition to be met. Hope this helps!!

Regards,

Prapanch

praprama
Cisco Employee
Cisco Employee

Hi,

Was just wondering if the query is resolved. if so, please mark this as answered

Thanks and Regards,

Prapanch

Hi Rama, thanks for the support

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers