How would I set up a Rule's conditions and actions to block the user that is being flagged as an intruder attempting something perceived as malicious?

I can see how to set up an action to block A user, but how do I specify the user that tinyids determines is potentially causing problems? I don't see any condition that provides that auto-selection.

Many thanks if you have the time to help me out.

Comments

deanflory’s picture

deanflory commented

I see there is a Condition called Data Comparison that lists these options:

report Tiny-IDS Report
report:0 Tiny-IDS Report
report:1 Tiny-IDS Report
report:2 Tiny-IDS Report
report:3 Tiny-IDS Report
report:0:source Source variable of intrusion.
report:0:value The original suspicious value.
report:0:save-value The plain suspicious value.
report:0:impact Overall impact of intrusion.
report:0:findings List of all detected findings.
report:0:findings:

...and Source variable of intrusion sounds closest but doesn't seem to pinpoint a user, dunno.

patrickd’s picture

patrickd commented

Hi!

The user of the intrusion is always the current sites user, you can find it by data selection at "site:current-user"

deanflory’s picture

deanflory commented

Thanks! I was wondering about that. 'Preciate your time.

patrickd’s picture

patrickd commented
Status: Active » Closed (fixed)

No problem