Hi all,
I configured some BLOCK responses in a "Server
Sensor?, when I receive Email notification for the
events I get BLOCK=Default:0 ,
does this means that The BLOK action was set but Not
Taken , or the default action is to block the attck?
The Full email is :
Sensor : server_sensor_XXX
Priority :medium
Date : 2005-06-15 11:58:45
Alert : HTTP_Cross_Site_Scripting
Source : 0.0.0.0/ 0 Destination: Destination :
X.X.X.X/ 55491
Action:
BLOCK=Default:0,DISPLAY=Default:0,LOGDB=LogWithoutRaw:0,EMAIL=Default:0
__________________________________
Discover Yahoo!
Use Yahoo! to plan a weekend, have fun online and more. Check it out!
http://discover.yahoo.com/
_______________________________________________
ISSForum mailing list
[email protected]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to [EMAIL PROTECTED]
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
