Filtering criteria/Thresholding.

Can someone (anyone) please look this over and tell me why it isn't working?
I'm trying to limit the number of email alerts generated for (right now) two
types of events. This feature is lacking good documentation for anyone who
isn't a developer or already familiar with it. I'm trying to ELIMINATE all
or most "Prelude Heartbeat" messages and I'm trying to set a high threshold
for "Multiple Windows audit failure events." (which comes from the OSSEC
Agent). What I have below is being accepted by Prelude Manager when I start
the service, but it isn't doing ANYTHING to the barrage of emails I'm
getting, and I have no idea what I'm doing wrong.

[smtp=hb]
sender = [email protected]
recipients = [email protected]
smtp-server = 10.x.x.x

[thresholding=heartbeat]
path = alert.classification.text
limit = 36000
count = 1
hook = smtp[hb]

[idmef-criteria=heartbeat]
rule = alert.classification.text == 'Prelude Heartbeat'
hook = thresholding[heartbeat]

[thresholding=AuditFailure]
path = alert.classification.text
limit = 3600
count = 10
hook = smtp[hb]

[idmef-criteria=AuditFailure]
rule = alert.classification.text == 'Multiple Windows audit failure events.'
hook = thresholding[AuditFailure]
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user