Group of layer 3 events.
Description
Group of layer 3 events.
Query · wazuh
field evecode="^1$"
Fires when
Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.
-
decoded_as=fortiddos-like -
field devid="^FI\S+|^FDD\S+" -
field evecode="^1$"
Refined by
17 rules chain off this one, narrowing it further.
- Effective rate limit for the protocol has been reached.
- Effective rate limit for the fragment threshold has been reached.
- Drops due to predefined IP header rules: Invalid header length (less than 5 words) total length less than 20 bytes End of Header before the data offset (while parsing options) length field in the LSRR or SSRR IP option is other than (3+(n*4)) where n is a value greater than or equal to 1 Pointer in the LSRR or SSRR IP option is other than (n*4) where n is a value greater than or equal to 1.
- An issue with hash collisions in the source tracking (ST) table.
- An issue with the source tracking (ST) table internal logic or memory.
Rule dependencies
Depends on
-
composes · Wazuh if_sid
44401