Next: , Previous: portmapperbro, Up: Predefined Variables



6.1.26 rules.bro

rule_actions : table[string] of count
Decide what to do when each rule (the index into the table) triggers: Ignore the rule (RULE_IGNORE); Process the rule but don't report it individually (RULE_QUIET); Log the match into rule_file (RULE_FILE); Log the match into both rule_file and the overall log file (generate an alert) (RULE_LOG). The default is RULE_FILE.
Note: This variable is const, so may only be changed via redef.

rule_file : file

The file into which rule-based alerts are logged.
Note: This variable is const, so may only be changed via redef.

horiz_scan_thresholds : set[count]

Log if for a pair (orig, rule) the number of different responders has reached one of the thresholds in this set.
Note: This variable is const, so may only be changed via redef.

vert_scan_thresholds : set[count]

Log if for a pair (orig, resp) the number of different rule matches has reached one of the thresholds in this set.
Note: This variable is const, so may only be changed via redef.