mirror of
https://github.com/fabriziosalmi/patterns.git
synced 2025-12-17 17:55:48 +00:00
5 lines
350 B
Plaintext
5 lines
350 B
Plaintext
@block_correlation {
|
|
path_regexp correlation "(?i)(@eq 0|@ge 5|@eq 0|@ge %{tx.inbound_anomaly_score_threshold}|@ge %{tx.outbound_anomaly_score_threshold}|@lt 2|@ge %{tx.inbound_anomaly_score_threshold}|@ge %{tx.outbound_anomaly_score_threshold}|@lt 3|@gt 0|@lt 4|@lt 1|@lt 1|@lt 2|@lt 2|@lt 3|@lt 3|@lt 4|@lt 4)"
|
|
}
|
|
respond @block_correlation 403
|