diff --git a/scripts/policy/protocols/http/detect-sqli.bro b/scripts/policy/protocols/http/detect-sqli.bro index 45a2bdb205..e2933626f7 100644 --- a/scripts/policy/protocols/http/detect-sqli.bro +++ b/scripts/policy/protocols/http/detect-sqli.bro @@ -35,13 +35,13 @@ export { event bro_init() { - Metrics::add_filter(SQL_ATTACKS, [$log=T, - $break_interval=1mins, + Metrics::add_filter(SQL_ATTACKS, [$log=F, + $break_interval=5mins, $note=SQL_Injection_Attacker]); - Metrics::add_filter(SQL_ATTACKS_AGAINST, [$log=T, - $break_interval=1mins, + Metrics::add_filter(SQL_ATTACKS_AGAINST, [$log=F, + $break_interval=5mins, $note=SQL_Injection_Attack, - $notice_thresholds=vector(10,100)]); + $notice_threshold=50]); } event http_request(c: connection, method: string, original_URI: string, @@ -51,7 +51,7 @@ event http_request(c: connection, method: string, original_URI: string, { add c$http$tags[URI_SQLI]; - Metrics::add_data(SQL_ATTACKS, [$host=c$id$orig_h]); - Metrics::add_data(SQL_ATTACKS_AGAINST, [$host=c$id$resp_h]); + Metrics::add_data(SQL_ATTACKS, [$host=c$id$orig_h], 1); + Metrics::add_data(SQL_ATTACKS_AGAINST, [$host=c$id$resp_h], 1); } } \ No newline at end of file