UGH PLEASE help here intrusion notices

[fastnoc]

there seems to be no option to qualify firewall notices and this blows my mind.

you have to know that if you’re hit by a script you’re going to see constant repeats of the intrusion attempt. so why in the world do you trigger an email every single time?

there should be a threshold to set only send notices at specific time intervals so yo don’t make my problems even worse by clogging up my exchange and inbox with spammed notices.

is this really not fixable without disabling? there seems to be no option to change the email address notices are sent to (silly) and no way to do anything other than trigger hits.

i have to be missing something. this is a great plugin but if used out of the box it actually creates a spam flood which is pretty much the exact opposite of helping me

Attachments:

You must be logged in to view attached files.

[Suman M.]

Hi, you can deactivate email notifications by setting “Notify Threshold” option to 0 under IDS Firewall tab.

[fastnoc]

but that doesn’t solve the problem. i can just turn monitoring off. you’re missing the point. turning off notification is saying I don’t care. i NEED to know when this happens. what i need is a setting to limit the emails. so for instance (send email only once every 5 minutes) would catch almost all the repeated email because it’s usually a brief but flooding hit. and if it lasts longer than 5 minutes I need to know because it could point to a ddos attempt

this isn’t a solution

I could just as well write a script that would detect this at the sever level and avoid going through the front end at all. i’m trying to find a way to make this effective. other than this issue I love this script

• This reply was modified 9 years, 1 month ago by fastnoc.
• This reply was modified 9 years, 1 month ago by fastnoc.

[Suman M.]

We got your point, but currently HMWP doesn’t have such feature for notification. We might add it in the upcoming versions of the plugin. Thanks for the suggestion.

[Author]

Posts