Novell SENTINEL 6.1 SP2, User Manual, Page: 160 / 528

160 Sentinel 6.1 User Guide
no
vd
ocx
(e
n)
7 Ja
nua
ry 201
0

Real-time attack data: Intrusion detection systems report real-time attacks against enterprise
assets. However, this data does not indicate the impact of the attacks.
The real-time attacks that are generated as events are loaded into the Sentinel database by using
the intrusion detection systems or vulnerability type Collectors.
8.2 Understanding Exploit Detection

Section 8.2.1, “How Exploit Detection Works,” on page 160

Section 8.2.2, “Generating the Exploit Detection File,” on page 162

Section 8.2.3, “Viewing the Events,” on page 162
8.2.1 How Exploit Detection Works
Exploit detection instantly sends notification when an attack is attempting to exploit a vulnerable
system. The Exploit Detection feature depends on the following:
 Both vulnerability scanners and the intrusion detection systems must report vulnerabilities and
attacks against the same set of systems. In Sentinel, systems are identified by their IP addresses
and their MSSP Customer Name. The MSSP Customer Name is a namespace identifier that
prevents overlapping IP ranges from matching incorrectly.

The vulnerability scanner and intrusion detection system products must be supported by the
Advisor service. This data uses specific product identifiers to ensure proper matching.
 The specific reported attacks and vulnerabilities must be known to the Advisor service and
Exploit Detection.
All Collectors shipped by Novell
®
meet these requirements, as long as they are declared as being
supported by Advisor. To write your own vulnerability or intrusion detection Collector, or to modify
one of the shipped Collectors, refer to the
Sentinel Plug-in SDK (http://developer.novell.com/wiki/
index.php?title=Develop_to_Sentinel) for specific information about which event and vulnerability
fields must be filled in to support this service.
The following table lists the supported products with their associated device type (IDS for intrusion
detection system, VULN for vulnerability scanners, and FW for firewall).
Table 8-1
Supported Products and the Associated Device Types
Supported Products Device Type RV31 Value
Cisco* Secure IDS IDS Secure
Enterasys* Dragon* Host Sensor IDS Dragon
Enterasys Dragon Network
Sensor IDS Dragon
Intrusion.com
(SecureNet_Provider) IDS SecureNet_Provider
ISS BlackICE PC Protection IDS XForce
ISS RealSecure* Desktop IDS XForce