Solved: Query regarding Rules in MARS

rashidsiddiqui · ‎09-17-2010

Hello Friends,

Please let me know what type of Event these rules will trigger? (REFER ATTACHED DOC SCREENSHOT)

Specifically I want to know the meaning behind “Count”. If I increase the count field to 2 or 3 what will it do.

Also the time I configured is 10 minutes. Is it like it will check the condition for a time period of 10 minutes? What is the significance of time field here?

praprama · ‎09-21-2010

Hi,

Was just wondering if the query is resolved. if so, please mark this as answered

Thanks and Regards,

Prapanch

View solution in original post

praprama · ‎09-17-2010

Hi Rashid,

The below link should give the description of each of the fields:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/user/guide/combo/rules.html#wp532081

The field "Count" refers to the number of times the event in the "Event" field has to fire within the "Time Range" specified for this Rule for the condition to be met. Hope this helps!!

Regards,

Prapanch

praprama · ‎09-21-2010

Hi,

Was just wondering if the query is resolved. if so, please mark this as answered

Thanks and Regards,

Prapanch

rashidsiddiqui · ‎09-23-2010

Hi Rama, thanks for the support