AnsweredAssumed Answered

Need assistance in creating a new alert using EPL

Question asked by Yadukrishnan J S on Sep 18, 2015
Latest reply on Sep 18, 2015 by linuts

Hi ,

 

I need assistance in creating the below rule using EPL.

 

The alert needs to be triggered if there are number of deny traffic followed by permit from a particular source to particular destination.

 

I have tried the RSA live rule which is excessive inbound traffic followed by success. But it is triggering alerts even if the traffic is from a source IP to multiple destinations.

 

Can any one help?

 

Regards,

Outcomes