search

enygma / expose

An Intrusion Detection System library loosely based on PHP IDS
MIT License
266 stars 55 forks source link

Integrate the concept of thresholds #11

Closed enygma closed 11 years ago

enygma commented 11 years ago

As it stands (for now) all results are processed and reported back to the admin of the system. A "threshold" system needs to be put in place to help reduce the noise from false positives.

These thresholds should be related to the Impact scores so that only runs (inline or the queued) that meet or are equal to the threshold have notifications sent.

Future idea: have thresholds/watches set on individual filters so that if they're tripped, the admin is notified regardless of if the total Impact level falls below the threshold.

enygma commented 11 years ago

The basic version of this feature has been implemented.