The signature module analyzes signature matches (see
§ .
In addition, the module identifies two types of exploit scans:
horizontal (a host triggers a signature for multiple destinations) and
vertical (a host triggers multiple signature for the same destination).
The module handles one event:
It provides the following redefinable variables:
Default: SIG_FILE.
[horiz_scan_thresholds : set[count]] Generate a log message whenever a remote host triggers a signature for the given number of hosts.
Default: { 5, 10, 50, 100, 500, 1000}
[vert_scan_thresholds : set[count]] Generate a log message whenever a remote host triggers the given number of signatures for the same destination.
Default: { 5, 10, 50, 100, 500, 1000}
The module defines one function for external use: