Intrusion event notification filters in an intrusion policy

An intrusion event notification filter in an intrusion policy is a security mechanism that

  • determines event importance based on frequency of occurrence or source and destination IP addresses,

  • allows administrators to specify thresholds for when events require attention, and

  • prevents system overwhelm by limiting notifications for widespread attacks.

Event notification filtering scenarios

The importance of an intrusion event can be based on frequency of occurrence, or on source or destination IP address. In some cases you may not care about an event until it has occurred a certain number of times. For example, you may not be concerned if someone attempts to log into a server until they fail a certain number of times. In other cases, you may only need to see a few occurrences to know there is a widespread problem. For example, if a DoS attack is launched against your web server, you may only need to see a few occurrences of an intrusion event to know that you need to address the situation. Your system is overwhelmed when it receives hundreds of the same event.