Tagged Questions
1
vote
1answer
151 views
How to find IPS events in sonicwall syslog
I have a sonicwall os firewall, and the security dashboard shows about 9 intrusion prevention events in the last month. Most are called "Suspicious CIFS traffic 4". I have syslog servers setup with ...
2
votes
1answer
780 views
Snort & Logging
I am looking for some support on using Snort in Windows 7. My experience so far is using WireShark, so this is new territory to me.
I would like to use Snort to perform a trace, which, after it ...
7
votes
2answers
158 views
Can you tell if an attack is successful by looking at IPS logs?
In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can ...
1
vote
1answer
170 views
OSSEC New Install: Scan and analyse full log?
When OSSEC is installed and started, it starts analyzing configured logs starting the date it was installed. Is there a way to have it scan and analyze the full logs?
6
votes
1answer
472 views
Intrusion Prevention Logs
I received an email from a client with IDS logs. I was wondering if the following log has any real indications of the server being compromised. If there are certain things I can do to diagnose the ...
15
votes
3answers
840 views
What techniques and tools do you use to relate security events?
You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck.
Do you have any cool ...
