Has anyone had this problem... I want to collect the IMPORTANT information from signatures such as WHO DID IT! The canned email response in Server Sensor will email to you the time, IP, event name, port (sometimes) but the part I really care about is not an option. When an account gets locked, deleted, created, rights change, a file is deleted, a service stopped, an admin acct had it's password attempted a few times incorrectly, etc. I can have an email response send me a useless email. Mine looks like this:
GMT: 2005-07-06 05:14:28 (-4 hours for EST) DNS_Spoof_Success Severity: medium Description: SuspiciousUDP Sensor that Detected Traffic: 192.168.1.1 (SERVER1_Sensor) Attacker IP: 192.168.1.2 Source Port: 53 (domain) Destination: 192.169.100.30 Destination Port: 1044 UDP (Port# 1044) Attack Successful? 2 User Name: N/A Resource ID: N/A Sub ID: N/A Application: N/A This is a bad example but at least you can see the template. Now in signatures where an offenders name, IP, NETBIOS name, etc. apply I want it in the email response. That info. *is* found in the Console. I can see all the data I wanted to get such as user name, user's IP, user's NETBIOS name, etc. but as far as I can tell that data cannot be included in the standard email response. The only way I can figure is to design custom scripts which do it. Does anyone have this problem and, if so, how have you solved it? Script? I wrote some tcl scripts to sort of do what I want and then a vb script which emails it to me but it just seems like there's got to be a better way. Anyone?? David _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
