Difference between revisions of "HIDS 9701"
From Atomicorp Wiki
(Created page with "'''Rule ID''' 9701 '''Status''' Active rule currently published '''Description''' This rule reports when dovecot has reported that a user has successfully authenticated....") |
m |
||
| Line 1: | Line 1: | ||
'''Rule ID''' | '''Rule ID''' | ||
| − | + | 9706 | |
'''Status''' | '''Status''' | ||
| Line 10: | Line 10: | ||
'''Description''' | '''Description''' | ||
| − | This rule reports when dovecot has reported that a user has | + | This rule reports when dovecot has reported that a user has disconnected from a session. '''This rules does not block anything, and you should not disable this rule.''' This rule is used by other rules to determine if a users account may have been compromised, and is also used for auditing purposes. |
'''This rule does not shun the offending IP by default and will not block the user. It has no adverse impact the user.''' | '''This rule does not shun the offending IP by default and will not block the user. It has no adverse impact the user.''' | ||
Latest revision as of 14:53, 17 December 2013
Rule ID
9706
Status
Active rule currently published
Description
This rule reports when dovecot has reported that a user has disconnected from a session. This rules does not block anything, and you should not disable this rule. This rule is used by other rules to determine if a users account may have been compromised, and is also used for auditing purposes.
This rule does not shun the offending IP by default and will not block the user. It has no adverse impact the user.
False Positives
None.
Tuning Recommendations
None.
