Signature Engines Ver3.0 Parameter

[fokamoto]

Just tune existing signature directly on the Sensor via the Signture Wizard.

I'd like to use GlobalSumamrize mode to reduce the alarms.

I set Parameters below:(SIGID=5081)

2 - AlarmThrottle = GlobalSummarize

15 - ThrottleInterval = 20

I got the first aralm that start a summary, but I couldn't get SUMMARY ALARM,

and never get the alarm of this signature any longer.

How can I get SUMMARY ALARM and this parameter settings is collect?

[jakasper]

Sorry for the tardy response.

There was a known defect in 3.0(1) with Summarize modes. The WEB alarms (such

as your 5081) would behave as FireOnce when set into a Summarize mode.

(This seems to be what you are experiencing).

Version 3.0(2) fixed the Summarize problems.

If you are already using 3.0(2), this may be an undiscovered defect.

Please give us information on your current version and your update history in the 3.0 train.

Thanks,

-JK