L�
I@R 隊[����r��z+,~��)���w* ʋ���,j��f���h����w�
��i�b�����w���'z����������At one point, I did this by creating a USER DEFINED
connection signature and I named the signaures the same...
Name Srcip SrcPort DstIp Dstport
IRC Any 6667 Any Any
IRC Any Any 6667 Any
That kind of thing. I don't know if you can still do this.
-----Original Message-----
From: Jeff M Garofola [mailto:[EMAIL PROTECTED]]
Sent: Tue 1/15/2002 9:27 AM
To: [EMAIL PROTECTED]
Cc:
Subject: Can RS Sensor Policies be Modifed to Log IRC in Both Directions?
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
To Whom this may concern:
In the past to limit my view of web traffic to certain hosts within my
domain, I set up a filter to block all http traffic to all my hosts, then
defined a connection event to allert me to http traffic to certain hosts
and set the pre-defined RS policies(Security Events) to record the
transactions(http_get, http_post, etc.). Similiarly I tried the same with
IRC to try to enhance its capabilites to record the session in both
directions,but failed. According to the 'help' screen the IRC_Msg Security
Event seems to record only messages sent by a user and not a response,
taking that the user is the session request originating from a host in my
domain.
Does anyone know if this event can be twicked to record the session in both
directions? Thank you in advanced.
Regards,
Jeff Garofola
Sr. Security Administrator
Electric Boat Corporation
Office: (860) 433-2289
