HIDS 30122
From Atomicorp Wiki
Rule ID
30122
Status
Active rule currently published
Description
This rule detects when multiple HIDS_30113 events occur. Specifically, this rule will shun if 10 30113 events occur from the same IP address within 60 seconds.
Certain DOS attacks use this method to use up all file handles in use on the system.
False Positives
None.
Tuning Recommendations
None.
