Chris,
Those three mechanisms work largely independently of one another. You
should receive one event for each of them that applies.
Paul
-----Original Message-----
From: issforum-bounces@atla-mm1.iss.net On Behalf Of Chris Norris/AMIG
Sent: Wednesday, February 23, 2005 3:05 PM
To: issforum@atla-mm1.iss.net
Subject: [ISSForum] Event/Rule Precedence
I have a question concerning the creation of "custom" event such as
"User Defined"and "Connection" type events. If a single packet matches
criteria for and XPU signature, and a user defined event, and a
connection event what will it be displayed as in the Sensor Analysis
tab. Will only 1 of those be selected based on some order of processing
or will it show up 3 times. My concern is that writing broad type of
connection event might mask more serious events if they only display 1
time.
Regards,
Chris Norris
American Modern Insurance Companies
Sr. Security Engineer
IS Risk and Security Management
7000 Midland Blvd.
Amelia, OH 45102
Ph: 513-947-5454
email: cnorris@amig.com
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
