graylog-plugin-correlation-count icon indicating copy to clipboard operation
graylog-plugin-correlation-count copied to clipboard

Published 20 hours ago • verified publisher icon airbus-cyber

Simplify this plugin

Open frantz45 opened this issue 3 years ago • 0 comments

Actually the plugin has 2 threshold types (more/less than), 2 streams and multiple time conditions (any/before/after). It makes the code complex.

Regarding the time conditions we could only keep before or after but not both (just invert the streams if you want the opposite order).

Regarding the threshold types we could only keep "more than". It's the most meaningful type regarding detection rules. "Less than" is mainly use with the "any" time condition to create exceptions. This last use case could be moved to another new plugin.

frantz45 avatar Jul 19 '22 15:07 frantz45