3.8 Rule Thresholds

Note:   Rule thresholds are deprecated and will not be supported in a future release. Use detection_filters () within rules, or event_filters () as standalone configurations instead.

threshold can be included as part of a rule, or you can use standalone thresholds that reference the generator and SID they are applied to. There is no functional difference between adding a threshold to a rule, or using a standalone threshold applied to the same rule. There is a logical difference. Some rules may only make sense with a threshold. These should incorporate the threshold into the rule. For instance, a rule for detecting a too many login password attempts may require more than 5 attempts. This can be done using the `limit' type of threshold. It makes sense that the threshold feature is an integral part of this rule.

3.8.0.0.1 Format

    threshold: \
        type <limit|threshold|both>, \
        track <by_src|by_dst>, \
        count <c>, seconds <s>;

Option	Description
type limit|threshold|both	type limit alerts on the 1st m events during the time interval, then ignores events for the rest of the time interval. Type threshold alerts every m times we see this event during the time interval. Type both alerts once per time interval after seeing m occurrences of the event, then ignores any additional events during the time interval.
track by_src|by_dst	rate is tracked either by source IP address, or destination IP address. This means count is maintained for each unique source IP addresses, or for each unique destination IP addresses. Ports or anything else are not tracked.
count c	number of rule matching in s seconds that will cause event_filter limit to be exceeded. c must be nonzero value.
seconds s	time period over which count is accrued. s must be nonzero value.

3.8.0.1 Examples

This rule logs the first event of this SID every 60 seconds.

    alert tcp $external_net any -> $http_servers $http_ports \
        (msg:"web-misc robots.txt access"; flow:to_server, established; \
        uricontent:"/robots.txt"; nocase; reference:nessus,10302; \
        classtype:web-application-activity; threshold:type limit, track \
        by_src, count 1 , seconds 60; sid:1000852; rev:1;)

This rule logs every 10th event on this SID during a 60 second interval. So if less than 10 events occur in 60 seconds, nothing gets logged. Once an event is logged, a new time period starts for type=threshold.

    alert tcp $external_net any -> $http_servers $http_ports \
        (msg:"web-misc robots.txt access"; flow:to_server, established; \
        uricontent:"/robots.txt"; nocase; reference:nessus,10302; \
        classtype:web-application-activity; threshold:type threshold, \
        track by_dst, count 10 , seconds 60 ; sid:1000852; rev:1;)

This rule logs at most one event every 60 seconds if at least 10 events on this SID are fired.

    alert tcp $external_net any -> $http_servers $http_ports \
        (msg:"web-misc robots.txt access"; flow:to_server, established; \
        uricontent:"/robots.txt"; nocase; reference:nessus,10302; \
        classtype:web-application-activity; threshold:type both, track \
        by_dst, count 10, seconds 60; sid:1000852; rev:1;)