;COMMENT: Warning on 30 dropped packets
;DESCRIPTION: Logs remote address responsible for 30 dropped packets. The packets must be incoming and show up within 30 minutes.

Dropped-Limit-Log	
		Comment = "Warning on 30 dropped packets within 30 minutes",
		Rule-Action = Observe,
		Alternate-Action = Observe,
		Dynamic-Alternate-Action = Log,
		Observation-Period = "00:30",
		Observe-Match-Count = 29,
		Packet-Feature = Dropped,
		Direction = Incoming,
		Security-Level = 99,
		Log-Control = Enabled,
		Log-Message = "30 packets dropped within 1 hour",
		Log-Details = "30 packets from the same IP address were dropped within an hour. The packets can be dropped by firewall rules, NAT, IPSec or other security features. The dropped packets are logged individually. Multiple dropped packets within a short period should cause general suspicion and depending on the security level, it will either cause logging or blacklisting.",
		Log-Severity = High,