Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have logs from a security appliance from Damballa which has cryptic names for threats observed in a network which I am trying to make sense of. Some examples of these threats are "RedTreeBruisers" , "WeirdSideTroop" , "WhiteBikeScorpions" ,etc. which I do not know how to interpret . I have over a 100 of these unique threat names with 3 words concatenated together. Unfortunately I don't have access to documentation / otherwise for this appliance. Any ideas what these threats mean & Is this a standard of some sort? What would be the best way to decode them?

share|improve this question
    
you might want to add the make/model/version of the security appliance in question, in case someone who does have access to the docs sees this question and might be able to help. –  Rоry McCune Jan 30 at 18:48
2  
Since the names you quote don't appear on the Internet (All Praises to Mighty Google !), one may infer that the names are automatically generated and represent some sort of three-symbol code. This may be a method for the appliance vendor to somehow ensure that customers will use his services to make sense of the data. –  Tom Leek Jan 30 at 19:20
    
When you say these are the "names," are these the names of the files or processes, the names of the programs, the names of the services listening on the TCP ports, etc? Or does the log not say? –  KnightOfNi Jan 30 at 20:14
    
These are the names of the "threats" that the appliance detected by observing traffic on the network –  DaTaBomB Jan 30 at 20:18

1 Answer 1

The appliance is obviously using arbitrary names to name/describe those threats.

Vendors often use such home-made naming/description conventions. For example:

And you can also find naming/description standards from the academic world or standard organizations, for example:

  • MITRE MAEC (standardized language for encoding and communicating high-fidelity information about malware based upon attributes such as behaviors, artifacts, and attack patterns)
  • IETF RFC 5070 (Incident Object Description Exchange Format)

Sometimes on those appliances you can find additional information in the detailed view that gives you the "official" name and variant of the detected threat.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.