[Bro] Is it possible to generate a alarm based on threshold value.

Manmeet Gill mgill6 at student.concordia.ab.ca
Sun Mar 13 18:08:06 PDT 2016


Example average number of connection per second for  port 21 Falls between
one to three connections per second. If Port 21 Falls above the average of
3 connections. Then there is abnormal behavior.
Above scenario is possible ? If it is then how?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160313/c60b6ffb/attachment-0001.html 


More information about the Bro mailing list