<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE lire:report-spec PUBLIC
  "-//LogReport.ORG//DTD Lire Report Specification Markup Language V1.0//EN"
  "http://www.logreport.org/LRSML/1.0/lrsml.dtd">
<lire:report-spec xmlns:lire="http://www.logreport.org/LRSML/"
 superservice="firewall" id="top-src-by-msg">

 <lire:title>Top Messages Firewall Report</lire:title>
 <lire:description>
  <para>This report shows the top source IPs that are at the origin of
   the messages (IDS alerts or others) generated by the firewall.
  </para>
 </lire:description>

 <lire:param-spec>
  <lire:param name="msgs_to_show" type="int">
   <lire:description>
    <para>This parameter controls the number of messages to show in
     the report.</para>
   </lire:description>
  </lire:param>

  <lire:param name="ips_to_show" type="int">
   <lire:description>
    <para>This parameter controls the number of source IPS to list
     with each message.
    </para>
   </lire:description>
  </lire:param>
 </lire:param-spec>


 <lire:display-spec>
  <lire:title>Source IPs by Message, Top $ips_to_show, Top
  $msgs_to_show messages</lire:title>
 </lire:display-spec>

 <lire:filter-spec>
  <lire:ne arg1="$msg" arg2="-"/>
 </lire:filter-spec>

 <lire:report-calc-spec>
  <lire:group sort="-msg_count" limit="$msgs_to_show">
   <lire:field name="msg"/>
   <lire:sum name="msg_count" field="count"/>
   <lire:group sort="-src_count" limit="$ips_to_show">
    <lire:field name="from_ip"/>
    <lire:sum name="src_count" field="count"/>
   </lire:group>
  </lire:group>
 </lire:report-calc-spec>

</lire:report-spec>

<!--
Keep this comment at the end of the file
Local variables:
mode: xml
-->
