On this page

OSSEC / HIDS Rule 20151

OSSEC / HIDS rule catalog

  • Rule family: OSSEC / HIDS
  • Rule ID: 20151
  • Definition status: Present in current source
  • Alert message / subject: Multiple IDS events from same source ip.
  • Rule level: 10
  • Definition checked: 2026-10-21
  • Configured frequency: $IDS_FREQ
  • Timeframe (seconds): 120
  • Ignore interval (seconds): 90

Correlation values are configuration attributes; event-count behavior depends on the manager version and parent rules.

Interpretation and response

This event is recorded as “Multiple IDS events from same source ip.” Review the originating log and the affected host or service to determine whether the activity was expected.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

The current rule explicitly disables Active Response for this event.

Documentation

The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.

Description

This rule is triggered when a third party Intrusion Detection system (IDS) has been detected by ASL, and the third party IDS has generated multiple alerts and/or blocked some action.

These events are not triggered, caused, configured or managed by by ASL, and ASL does not cause the blocking action or alert. The Third Party IDS is the cause of this event.

Details

This rule is designed to detect third party IDS’ and to alert you if they have generated an alert and/or blocked some action. The third party IDS may also have generated a false positive (false alarm), and may have blocked a non-malicious action. ASL generates an alert for these conditions in case you wish to investigate the actions of your third party IDS further.

ASL does not control or configure this behavior, it merely reports when this occurs. Therefore, if your third party IDS is in error, please contact the vendor for this third party IDS for assistance with configuring it.

ASL will not shun, by default, on these events however if you wish to have ASL block on these events please see the Tuning Advice section below.

Disabling this rule will not prevent your third party IDS from alerting or blocking this activity. It will simply “silence” the alert in ASL, however the third party IDS will continue to alert and/or block this activity. We do not recommend you disable this rule.

Detected Third Party IDS'

ASL can detect alerts, and if configured can also block attacks based on alerts from a number of third party IDS’ products. Examples of third party IDS’ that ASL can detect alerts:

  • SNORT
  • suhosin
  • dragon-nids
  • BRO IDS

Note: These are not installed by ASL (historical reference). If you are getting alerts from these products, and require assistance configuring these third party IDS’, please contact the third party IDS’ vendor. We do not support, and ASL does not install these products.

Troubleshooting

False Positives

This rule is not caused by ASL (historical reference). ASL merely reports that a third party IDS is alerting on some activity.

Tuning Guidance

If you wish to shun on these alerts, just set Active Response in the ASL (historical reference) rule manager for rule 20101 to “yes”.

Disabling this rule will not prevent your third party IDS from alerting or blocking this activity. It will simply “silence” the alert in ASL. The third party IDS will continue to alert and/or block this activity. We do not recommend you disable this rule.

Additional Information

Example log messages

suhosin

Illustrative event summary (not a captured log): OSSEC/HIDS 20151 — Multiple IDS events from same source ip..

snort

Illustrative third-party IDS event: Multiple IDS events from same source ip.. Check the originating IDS alert for its interpretation.

Source and revision

Migrated from HIDS_20151, wiki page 467, revision 3780 (20130731). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .