Re: Is there a notification on a rate_filter threshold being reached?

["Joel Esler \(jesler\) via Snort-sigs" <snort-sigs () lists snort org>]

Hello roni,

There is not a notification that the rate_filter has been reached, other than you receiving an alert on the rule where 
the rate filter has been reached.


-- 
Joel Esler
Manager, Communities Division
Cisco Talos Intelligence Group
http://www.talosintelligence.com | https://www.snort.org

> On Jun 21, 2020, at 4:49 AM, roni gur via Snort-sigs <snort-sigs () lists snort org> wrote:
>
> Hi,
> I implemented a rate_filter threshold, but is there a way to generate an alert for that rate_filter actually being 
> reached, so I would know that I need to look into that?
>
> I should note that I'm using rate_filter primarily because I don't want to track my events by src or dst, and hence 
> use the by_rule option.
>
> 10x,
> Roni.
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs () lists snort org
> https://lists.snort.org/mailman/listinfo/snort-sigs
>
> Please visit http://blog.snort.org for the latest news about Snort!
>
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
>
> Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
> href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!

Attachment: smime.p7s
Description:

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!