cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
408
Views
5
Helpful
1
Replies

Descriptors

lm20ele
Level 1
Level 1

I don't quite understand the Destination Descriptors when writing a rule. For example, I'm checking the default "System Rule: Password Attacks: SNMP - Attempt" and under Destination IP there are these three descriptors "Same", "$Target01" and "Any". Are these overlapping?? Any means any IP. Doesn't fall into "same" IP descriptor?.

Also, "$Target01" means to me that same variable in another field has the same value. Isn't this the same as using "same" descriptor?

Not so clear.

1 Reply 1

mhellman
Level 7
Level 7

I can't answer why offsets have all three...makes no sense to me and I've always wondered why.

I can tell you the difference between $TARGET01 and SAME. the target variables are a way of matching outside of a single offset. So I can create an offset with a target01 variable, and then essentially refer to the matching IP address in a later offset. The SAME variable only matches within an offset.

I will illustrate using two "rules" below

offset,source,event,count

1,same,event A,100

2,same,event B,10

1,target01,event A,100

2,target01,event B,10

The first offset in both rules will match 100 "events A" events with the same IP address, y.y.y.y. If 10 "event B" events are received all with ip address x.x.x.x, the second rule won't match but the first one will. Clear as mud?

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: