Sagan unknown stable other

[RSA-DPM] Swap-Memory Memory status Yellow

[RSA-DPM] Swap-Memory Memory status Yellow

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[RSA-DPM] Swap-Memory Memory status Yellow"; content: "RKMA_MONITORING_EVENT"; content: "Type
| 3a
| Swap-Memory"; content: "YELLOW"; distance: 45; within: 25; threshold: type suppress, track by_src, count 5, seconds 900;  sid:5003940; rev:4;)

Field Validations

Loading…

Comments (0)

Loading comments...