Hi All,
Is it possible to raise toe severity (from Medium to
Height) of an event if it occurs more that a defined
threshold? I want to do it for POP3_Auth_Failed if it
occurs from one SOURCE more that 5 time peer minute
or
..
If I can send Response mail only for that event (which
exceed the thershold )it will be much better ??
In reality, we have an Exchange Server, and weve a
lot of POP3_Auth_Failed from Insider and also from
outsider, we want to do this for outsider who try to
do a dictionary attach against POP3, by arising the
severity we can distinguish between normal and anormal
Authentication Failed .
Hope I was clear!
Best Regards
Thanks
Hic Sonni
__________________________________
Yahoo! Mail - PC Magazine Editors' Choice 2005
http://mail.yahoo.com
_______________________________________________
ISSForum mailing list
[email protected]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to [EMAIL PROTECTED]
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
