Counters¶
Aim:¶
Count occurrences of particular event repeated over a short period time.
This evolution is meant to add the possibility to aggregate alerts easier.
Solution 1:¶
Add a field (Integer) counter in Alert Class
Impacted Class | Proposed Field | Type |
---|---|---|
Alert | counter | Integer |
Pros¶
Cons¶
Meetings:¶
30/10/2015 Meeting : Counting occurrences may be useful in two situations :- To count events occurring repeatedly over a short period of time. This may need to define what a short period of time is. In this case the counter should be linked to the duration of the attack. The counter should also be placed near the original log.
- To count alerts in a correlation alert. This should be an attribute in a Correlation Alert.
YV: To be discussed.
VH: The counter is considered being set when the alert is created which avoids problems with the alerts being changed over time.
Commentaire HD/YV:
- Non pertinent -> CorrelationAlert.