Sysadmin Notifications

[Hirsh, Joshua]

> And if this netsky or any other viruses came out from an internal IP
> address? This woud be important to me to know, independent of
> the virus
> kind...


 The rulesets support simple AND functions. I'm not sure if this one in
particular supports IP's as well as the virus names. Play around with it and
give it a shot.

 Maybe something like this?

 Virus: sobig   and From: domain.com    yes
 Virus: sobig   no

 I haven't tested it, so it might not work... but if it does, great! ;-)


-Joshua