Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Customize rule usage #869

Open
muddlelife opened this issue Nov 28, 2023 · 0 comments
Open

Customize rule usage #869

muddlelife opened this issue Nov 28, 2023 · 0 comments

Comments

@muddlelife
Copy link

Hello, suppose I have two rules 100001 and 100002, and rules 100001 and 100002 both have time range and ignore time, now I need to define a new rule 100003, this rule is to fire 100001 and 100002 at the same time, and is the same IP, ignore time 120s, ignore time. Rule time range 300s, can trigger 100003 rule, I used the following way to write, but the result is wrong with my imagination, can you tell me how to write this rule, thank you

<rule id="100003" level="14" timeframe="300" ignore="120" > -->
    <if_matched_sid>100001</if_matched_sid>
    <if_matched_sid>100002</if_matched_sid>
    <same_source_ip/>
    <description>xxxxx</description>
</rule>>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant