As I can see  it must be hourly cron-job from host1 to host2 via FTP Every hour  I get 5 false positives of this alert Only between these hosts My pass-rule  I wrote below doesn't work  or it works but also triggers the alert-rule