Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For example, you are using Snort and you just got a serious event, which states that a certain service is attacked.

What do you do with the threat source IP?

What are the steps that network event analyst performs?

Edit: Narrowing the question down, how it is dealt with such threats, instantly block ip? Gather evidence? Reroute the traffic for further analysis? I just need some behavior examples on example situations.

Edit2: Specifically, DoS/DDoS attacks.

share|improve this question

closed as too broad by Adi, Xander, TildalWave, Rory Alsop Jul 9 '13 at 16:41

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

This question is extremely broad. It's very difficult to even begin to cover it. I'm gonna have to vote to put it on hold until you make it a bit narrower. – Adi Jul 9 '13 at 15:11
Sorry, Ren. Still very broad. Reacting to a threat depends on the nature of the threat itself. What you're asking is how to react to all threats. – Adi Jul 9 '13 at 15:33
And if it helps, there are already a number of questions on how to identify and respond to DoS or DDoS attacks. – Xander Jul 9 '13 at 16:10

Look up your security procedures and invoke your incident handling process as appropriate.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.