threshold
threshold(阈值)关键字可用于控制规则的警报频率,它有3种模式:
threshold: type <threshold|limit|both>, track <by_src|by_dst>, count <N>, seconds <T>
type “threshold”
此类型可用于在规则生成警报之前为其设置最小阈值,下面的例子表示,如果我们在一分钟的时间内从同一台服务器获得10个或更多入站电子邮件则触发警报
alert tcp !$HOME_NET any -> $HOME_NET 25 (msg:"ET POLICY Inbound Frequent Emails - Possible Spambot Inbound"; flow:established; content:"mail from|3a|"; nocase; threshold: type threshold, track by_src, count 10, seconds 60; reference:url,doc.emergingthreats.net/2002087; classtype:misc-activity; sid:2002087; rev:10;)
type “limit”
这种类型可以用来确保你不会被警报充斥。如果设置为限制N,它最多会发出N次警报,下面的例子表示,如果检测到MSIE 6.0,则每3分钟内最多会生成一个警报
alert http $HOME_NET any -> any $HTTP_PORTS (msg:"ET USER_AGENTS Internet Explorer 6 in use - Significant Security Risk"; flow:to_server,established; content:"|0d 0a|User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 6.0|3b|"; threshold: type limit, track by_src, seconds 180, count 1; reference:url,doc.emergingthreats.net/2010706; classtype:policy-violation; sid:2010706; rev:7;)
type “both”
这种类型是“threshold”和“limit”类型的组合,下面的例子表示,如果在6分钟内出现了5次或更多的“SIP / 2.0 401未经授权”响应,该警报将仅生成警报,并且在6分钟内仅会发出一次警报
alert tcp $HOME_NET 5060 -> $EXTERNAL_NET any (msg:"ET VOIP Multiple Unauthorized SIP Responses TCP"; flow:established,from_server; content:"SIP/2.0 401 Unauthorized"; depth:24; threshold: type both, track by_src, count 5, seconds 360; reference:url,doc.emergingthreats.net/2003194; classtype:attempted-dos; sid:2003194; rev:6;)
track
by_src/by_dst分别表示通过源IP地址/目的IP地址追踪进行规则的匹配
detection_filter
因为它在达到初始阈值后为每个规则匹配生成警报,其中后者将重置其内部计数器,并在再次达到阈值时再次发出警报,下面的例子表示,2秒的时间内匹配到15次则触发一次警报,然后把计数归零,再次达到15次以后再次触发警报
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER WebResource.axd access without t (time) parameter - possible ASP padding-oracle exploit"; flow:established,to_server; content:"GET"; http_method; content:"WebResource.axd"; http_uri; nocase; content:!"&t="; http_uri; nocase; content:!"&|3b|t="; http_uri; nocase; detection_filter:track by_src,count 15,seconds 2; reference:url,netifera.com/research/; reference:url,www.microsoft.com/technet/security/advisory/2416728.mspx; classtype:web-application-attack; sid:2011807; rev:5;)
suppress
Suppressions 可用于抑制规则或主机/网络的警报
suppress gen_id <gid>, sig_id <sid> suppress gen_id <gid>, sig_id <sid>, track <by_src|by_dst>, ip <ip|subnet>
这将确保规则2002087永远不会匹配src主机209.132.180.67
suppress gen_id 1, sig_id 2002087, track by_src, ip 209.132.180.67