hi all i have a little confusion abt the event count parameter in the signatures.

i am not sure whether this parameter is for firing the signatures or for writing the events to the event store.

by default the event count is set to 1.

if i set the event count to 5 for a particular signature.

say for icmp echo request. if i set the signature event count to 5 within 10 seconds interval. and the signature action is to deny the packet inline.

then when the first icmp echo request is send will the signature be fired i mean will the packet be dropped.

or the packet will be dropped only if 5 icmp echo requests are send within 10 seconds.

can someone pls clear my doubt.

regards

sebastan