rate
Syntax: --rate <matches_int>,<time_int>;
Description:
Instead of generating log entries every time the signature is detected, use this keyword to generate a log entry only if the signature is detected a specified number of times within a specified time period.
• <matches_int> is the number of times a signature must be detected.
• <time_int> is the length of time in which the signature must be detected, in seconds.
For example, if a custom signature detects a pattern, a log entry will be created every time the signature is detected. If --rate 100,10; is added to the signature, a log entry will be created if the signature is detected 100 times in the previous 10 seconds. Use this command with --track to further limit log entries to when the specified number of detections occur within a certain time period involving the same source or destination address rather than all addresses.