Re: time based events
Yoann Vandoorselaere <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Hi Alec, Le vendredi 19 septembre 2008 à 17:34 +0300, Alec a écrit : > Hi, > I am trying to get windows failed login alerts by email, > my problem is that i want to get this alerts only after 8p.m and till 8a.m. > does it possible? You can achieve this using a Prelude-Manager idmef-criteria filter: [idmef-criteria] rule = your_other_criteria && (alert.detect_time >= 'hour:20' || alert.detect_time < 'hour:8') hook = smtp[default] -- Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies Tel: +33 (0)9 50 70 21 58 Fax: +33(0)4 78 42 21 58 http://www.prelude-ids.com _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user