rule_actions : table[string] of count
Decide what to do when each rule (the index into the table) triggers: Ignore the rule (RULE_IGNORE); Process the rule but don't report it individually (RULE_QUIET); Log the match intorule_file
(RULE_FILE); Log the match into bothrule_file
and the overall log file (generate an alert) (RULE_LOG). The default is RULE_FILE.
Note: This variable isconst
, so may only be changed viaredef
.
rule_file : file
The file into which rule-based alerts are logged.
Note: This variable isconst
, so may only be changed viaredef
.
horiz_scan_thresholds : set[count]
Log if for a pair (orig, rule) the number of different responders has reached one of the thresholds in this set.
Note: This variable isconst
, so may only be changed viaredef
.
vert_scan_thresholds : set[count]
Log if for a pair (orig, resp) the number of different rule matches has reached one of the thresholds in this set.
Note: This variable isconst
, so may only be changed viaredef
.