TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
You can set up event propagation for any RealSecure decode in the policy
editor under the advanced options, this can reduce the number of times that
an event is reported or logged, based on parameters that you choose.
Brian Fitch, IDS Named Accounts Engineer
Internet Security Systems, Inc.
Platinum Support 1-866-259-4779|[EMAIL PROTECTED]
Platinum Support hours Mon-Fri 8:30am - 5:30pm EDT
-----Original Message-----
From: Dan Wangler [mailto:[EMAIL PROTECTED]]
Sent: Thursday, September 20, 2001 1:07 PM
To: [EMAIL PROTECTED]
Subject: RS Alerting
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
We have RS 6.0 installed with 12 Nokia appliances running RS Network Sensor.
Tuesday, we started seeing the nimba worm when three specific signatures
started trapping at a much increased rate than before.
Is there some way to establish a baseline of hits, a level that we are aware
of, a level that we are logging to our database for further consideration
but
which are not logging to the console nor paging us but then alert us if that
threshhold is exceeded?
For instance, if we see 50 Windows Executables signature hit daily, we want
to
trap on those and analyze them as we get time but understand that we will
receive a certain amount of these daily. However, on Tuesday, we had over
50,000 hits. Is there a way to page us not before but once a threshhold is
exceeded?
Thanks
Dan Wangler, GIAC Certified Intrusion Analyst
IT Security Response Team, Texas Instruments, Inc.
Spring Creek Bldg 1, C196,
6500 Chase Oaks, Blvd, MS 8417, Plano, Texas, 85023
Tel #; 214-567-8304; Email:; [EMAIL PROTECTED]
