340
edits
Incidents: Difference between revisions
→Add/modify a rule
No edit summary |
|||
| Line 54: | Line 54: | ||
*** If a time span parameter is used for attributes, the capture time includes this time duration as well. | *** If a time span parameter is used for attributes, the capture time includes this time duration as well. | ||
** The traffic is automatically filtered to only contain the traffic that actually triggered the rule, i.e., an IP address or an IP group for IP rules. | ** The traffic is automatically filtered to only contain the traffic that actually triggered the rule, i.e., an IP address or an IP group for IP rules. | ||
* Trigger cooldown: Depending on the selected trigger, once the incident was activated and finished, the trigger will wait for this cooldown period before the next incident may be triggered again. Each rule will have a seperate cooldown timer. The cooldown period may be configured in seconds. | |||
=== Available triggers === | === Available triggers === | ||