And do you think it's normal?!
Why does sensor set cleared bit on?
Cleared bit should be set on after I've cleared event from console by
myself, and only after that.
If it's true, I don't understand what is it for, and I think this should be
fixed.
Thanks.
---
Best regards, Sergey V. Soldatov.
Information security department.
tel/fax +7 095 745 89 50 (1613)
NotPhunny Dude
<morriswurm@yahoo.com> To: Sergey V Soldatov
<SVSoldatov@tnk.ru>, issforum@iss.net
cc:
25.03.2005 20:14 Subject: Re: [ISSForum]
LOGDB:LogWithRaw
I've noticed some instances when you have a signature
set to LogWithRaw, and its automatically cleared by
the sensor. That is, as soon as the event is generated
on the sensor, the sensor sets the cleared bit to 1,
and as such, you never see the event in the console
display. If you want to see any cleared events, just
configure your console to include the Cleared Count
column as well.
Cheers
- Jack
--- Sergey V Soldatov <SVSoldatov@tnk.ru> wrote:
AFAIK, LogWithRaw is the only convenient way to see
raw packet data of
event. In this case raw packet data will bw stored
in DB and can be viewed
in event details. Please, if someone has something
to add to my explanation
about LogWithRaw, inform me, because this parameter
is very poor descrabed
in docs and student's guides.
I tried to use this for analysis of IM activities,
LDAP sessions, etc,
where user credentials are transferred in clear
text. But I'd found that
after changing LOGDB form LogWithoutRow to
LogWithRaw these events had
stopped to be shown in SP Console. I could see
events with LogWithRaw
switched on in Event Viewer, but not in Console. Can
someone help me to
understand what's the problem?
Another question is for ISS or somebody who knows
ISS's future plans.
Does ISS plan to realize storage of evidence in DB?
Because in current
implementation LogEvidence feature almost useless,
because it's completely
impossible to find needed evidence for desired
event, especially in case
when number of events have Log Evidence switched on.
I wrote about this on
enhancements@iss.net, but I don't knoe the fate of
that letter.
Thanks.
---
Best regards, Sergey V. Soldatov.
Information security department.
tel/fax +7 095 745 89 50 (1613)
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to
mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by
Internet Security Systems, 6303 Barfield Road,
Atlanta, Georgia, USA 30328.
__________________________________
Do you Yahoo!?
Yahoo! Small Business - Try our new resources site!
http://smallbusiness.yahoo.com/resources/
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
