Detection Logic
alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"mattermost"; program: mattermost; metadata: fingerprint_source logs, fingerprint_os linux, fingerprint_type client, fingerprint_expire 7200; classtype: fingerprint; threshold: type limit, track by_src, seconds 3600, count 1; sid: 5100032; rev:1;)Field Validations
Loading…
Comments (0)
Loading comments...