TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Dan,
here's a working treshhold based pager-solution we use for RS5.5:
- User-defined event on every med and high event (fills a text file, one
line per event)
- Periodic [secured] transfer of text file from every sensor to manager
On Workgroup-manager there's a PERL script running, merging and checking the
text file.
If there are more than the defined threshhold of events
(we currently use a treshhold of 10 events every 10 minutes),
we get paged.
I'm thinking of porting this solution to RS 6.0. It is much easier here,
because the database is always up to date. No user-defined event,
no transfer between sensors and manager.
It just needs a modificaton of PERL script. Instead of analysing the text
file,
the PERL script should check the SQL database.
Anybody having experience with SQL-queries under PERL?
Regards,
Phil
-----Urspr�ngliche Nachricht-----
Von: Dan Wangler [mailto:[EMAIL PROTECTED]]
Gesendet: Donnerstag, 20. September 2001 19:07
An: [EMAIL PROTECTED]
Betreff: RS Alerting
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
We have RS 6.0 installed with 12 Nokia appliances running RS Network Sensor.
Tuesday, we started seeing the nimba worm when three specific signatures
started trapping at a much increased rate than before.
Is there some way to establish a baseline of hits, a level that we are aware
of, a level that we are logging to our database for further consideration
but
which are not logging to the console nor paging us but then alert us if that
threshhold is exceeded?
For instance, if we see 50 Windows Executables signature hit daily, we want
to
trap on those and analyze them as we get time but understand that we will
receive a certain amount of these daily. However, on Tuesday, we had over
50,000 hits. Is there a way to page us not before but once a threshhold is
exceeded?
Thanks
Dan Wangler, GIAC Certified Intrusion Analyst
IT Security Response Team, Texas Instruments, Inc.
Spring Creek Bldg 1, C196,
6500 Chase Oaks, Blvd, MS 8417, Plano, Texas, 85023
Tel #; 214-567-8304; Email:; [EMAIL PROTECTED]
