Video Screencast Help

Rule question

Created: 19 Dec 2012 • Updated: 03 Jan 2013 | 2 comments
Mike Buckley's picture
This issue has been solved. See solution.

I'm not sure this is possible but I'm canvassing opinion as I'm stuck.

I need to write a rule for a many to one event followed by a single event (an example of this would be multiple password guess attempts followed by a successful login).  The problem I have is the event count - using an X followd by Y rule the event count is global - I'd like to set the event count per condition.  Setting it globally means that for an example of 100 guesses followed by a successful login, X needs to be 100 and Y needs to be 1, set the event count to 100 and it will never trigger, set it to 1 and it will trigger every time a user fat fingers their password.

Anybody think of a way round it?

 

Thx

Comments 2 CommentsJump to latest comment

wste's picture

Mike,

What about a rule type of Multi-condition?  In 4.7.4 and 4.8 that allows for different event counts for two sets of rule critera.  For example, define your set of criteria for failed password attempts and set an event count of 100, then define another set of criteria to identify a successful password attempt with an event count of 1.

-w

 

SOLUTION
Mike Buckley's picture

Ah nice one, hadn't seen that rule.