TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
Hi Alan, Answering your query.... Actions Mask is a bit wise field that represents the actions taken on that event. It's equivalent to the box on the lower right of the event inspector. The bits are as follows: ACT_IGN = 0x00000000 ACT_KILL =0x00000001 ACT_VIEW_SHELL = 0x00000002 ACT_EMAIL = 0x00000004 ACT_LOG_RAW= 0x00000008 ACT_LOG_TEXT = 0x00000010 ACT_LOG_INFO = 0x00000020 ACT_DISPLAY = 0x00000040 ACT_USERDEF = 0x00000080 ACT_MOREINFO =0x00000100 ACT_LOG_DB = 0x00000200 ACT_FIREWALL = 0x00000400 ACT_SNMP_TRAP = 0x00000800 ACT_USER_SPECIFIED1 = 0x00001000 ACT_USER_SPECIFIED2 =0x00002000 ACT_USER_SPECIFIED3 = 0x00004000 ACT_USER_SPECIFIED4 = 0x00008000 ACT_LMF_NOTIFY = 0x00010000 For example, if you had the Response Type set to LOGDB, DISPLAY, and EMAIL, then you would see Actions mask: 0x244. All these depends on how you have Real Secure setup to report certain checks. Hope this answers your queries... rgds, Pradeepa -----Original Message----- From: Alan Phua [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 12, 2001 8:56 AM To: Issforum Subject: Understanding Action Mask from Email Alert TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ------------------------------------------------------------------------ ---- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, Sorry for the duplicated email... Is the a way for the RealSecure administrator to know what action is taken by the RealSecure Sensor by just looking at the email alert? Eg. RealSecure Kill/Log to Database/Reconfiguration of Firewall/Running of Script... Currently, only the action mask with some bitwise number is shown in the mail alert. Eg. "Action Mask = 0x245" Thanks in advance... Regards, Alan Phua Enterprise Security Services TriSecurity Pte Ltd Tel : +65 481 6996 Mobile : +65 9695 0466 Email : [EMAIL PROTECTED] PGP: FCFA 1FC5 4800 35C1 4F1A BD7D 152B C214 ED10 403F -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQA/AwUBPBbOXBUrwhTtEEA/EQKRnQCg5n5hSFjBXmJ3qE+xa+ZpjY7BEeMAoK8p A/pW3mh/J00dr9wF1ojEoUTk =rT08 -----END PGP SIGNATURE-----
