|Alert Message||Multiple Firewall drop events from same source.|
ASL has detected multiple attempts to access a port that the firewall has been configured by the user to block, and ASL has blocked this access. When ASL detects this has occurred multiple times, it will also shun the IP address based on the OSSEC_SHUN_TIME configured on the system.
If you do not wish to block access to this port, please see the Tuning Guidance below.
To configure the firewall to allow connections to this port, please see the ASL firewall documentation page.
Knowledge Base Articles