And do you think it's normal?!
Why does sensor set cleared bit on?
Cleared bit should be set on after I've cleared event from console by
myself, and only after that.
If it's true, I don't understand what is it for, and I think this should be
fixed.
Thanks.
---
Best regards, Sergey V. Soldatov.
Information security department.
tel/fax +7 095 745 89 50 (1613)
NotPhunny Dude
<[EMAIL PROTECTED]> To: Sergey V Soldatov <[EMAIL
PROTECTED]>, [email protected]
cc:
25.03.2005 20:14 Subject: Re: [ISSForum]
LOGDB:LogWithRaw
I've noticed some instances when you have a signature
set to LogWithRaw, and its automatically cleared by
the sensor. That is, as soon as the event is generated
on the sensor, the sensor sets the cleared bit to 1,
and as such, you never see the event in the console
display. If you want to see any cleared events, just
configure your console to include the Cleared Count
column as well.
Cheers
- Jack
--- Sergey V Soldatov <[EMAIL PROTECTED]> wrote:
> AFAIK, LogWithRaw is the only convenient way to see
> raw packet data of
> event. In this case raw packet data will bw stored
> in DB and can be viewed
> in event details. Please, if someone has something
> to add to my explanation
> about LogWithRaw, inform me, because this parameter
> is very poor descrabed
> in docs and student's guides.
>
> I tried to use this for analysis of IM activities,
> LDAP sessions, etc,
> where user credentials are transferred in clear
> text. But I'd found that
> after changing LOGDB form LogWithoutRow to
> LogWithRaw these events had
> stopped to be shown in SP Console. I could see
> events with LogWithRaw
> switched on in Event Viewer, but not in Console. Can
> someone help me to
> understand what's the problem?
>
> Another question is for ISS or somebody who knows
> ISS's future plans.
> Does ISS plan to realize storage of evidence in DB?
> Because in current
> implementation LogEvidence feature almost useless,
> because it's completely
> impossible to find needed evidence for desired
> event, especially in case
> when number of events have Log Evidence switched on.
> I wrote about this on
> [EMAIL PROTECTED], but I don't knoe the fate of
> that letter.
>
> Thanks.
>
> ---
> Best regards, Sergey V. Soldatov.
> Information security department.
> tel/fax +7 095 745 89 50 (1613)
>
> _______________________________________________
> ISSForum mailing list
> [email protected]
>
> TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
> https://atla-mm1.iss.net/mailman/listinfo/issforum
>
> To contact the ISSForum Moderator, send email to
> [EMAIL PROTECTED]
>
> The ISSForum mailing list is hosted and managed by
> Internet Security Systems, 6303 Barfield Road,
> Atlanta, Georgia, USA 30328.
>
__________________________________
Do you Yahoo!?
Yahoo! Small Business - Try our new resources site!
http://smallbusiness.yahoo.com/resources/
_______________________________________________
ISSForum mailing list
[email protected]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to [EMAIL PROTECTED]
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
