Detection Logic
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[NXLOG] Unable to read eventlog"; content: "EvtNext failed with error 15007
| 3a
| "; flexbits: isnotset,by_src,nxlog_problem;after: track by_src, count 5, seconds 300; threshold: type suppress, track by_src, count 1, seconds 86400; flexbits: set,nxlog_problem,86400; classtype: program-error; program: nxlog; sid:5003108; rev:6;)Field Validations
Loading…
Comments (0)
Loading comments...