Detection Logic
alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[INCAPSULA] DDoS"; program: Incapsula*
| incapsula*; content: "
| 7c
| DDoS
| 7c
| "; parse_src_ip: 1; threshold: type suppress, track by_src, count 50, seconds 1800; classtype: system-event; sid:5003924; rev:5;)Field Validations
Loading…
Comments (0)
Loading comments...