HIDS 11252
From Atomicorp Wiki
| Rule 11252 | |
|---|---|
| Status | Active |
| Alert Message | Multiple connection attempts from same source. |
Contents |
Description
ASL is reporting that a client has made multiple successful FTP login attempts to the system within a very short period of time (10 connections in 60 seconds).
ASL will not shun on this event, so there is no effect on the end user. We not recommend you disable this rule.
Troubleshooting
False Positives
None.
If you do not wish to be alerted to these events, simply disable the rule.
Tuning Guidance
None.
Additional Information
Similar Rules
None.
Knowledge Base Articles
None.
Outside References
None.
