AFAIK, LogWithRaw is the only convenient way to see raw packet data of
event. In this case raw packet data will bw stored in DB and can be viewed
in event details. Please, if someone has something to add to my explanation
about LogWithRaw, inform me, because this parameter is very poor descrabed
in docs and student's guides.
I tried to use this for analysis of IM activities, LDAP sessions, etc,
where user credentials are transferred in clear text. But I'd found that
after changing LOGDB form LogWithoutRow to LogWithRaw these events had
stopped to be shown in SP Console. I could see events with LogWithRaw
switched on in Event Viewer, but not in Console. Can someone help me to
understand what's the problem?
Another question is for ISS or somebody who knows ISS's future plans.
Does ISS plan to realize storage of evidence in DB? Because in current
implementation LogEvidence feature almost useless, because it's completely
impossible to find needed evidence for desired event, especially in case
when number of events have Log Evidence switched on. I wrote about this on
enhancements@iss.net, but I don't knoe the fate of that letter.
Thanks.
---
Best regards, Sergey V. Soldatov.
Information security department.
tel/fax +7 095 745 89 50 (1613)
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
