WTI PollCat NetLink, User Manual

Page: 110 / 256

Example 2: After Hours Long Distance Calls.
This clue counts long distance calls placed after 6:00 pm and
before 7:00 am. This type of call could indicate that a hacker has
obtained an access code for an outside line and is using the line to
dial long distance numbers after work hours.
For this example, assume that the Alarm Filter Format is defined
as shown below. Note that the first three lines in Figure 8.8 are
sample call records, and the fourth line is the Alarm Filter Format.
The variables B, C, and E are not used for this clue.
Where:
A is the time the call was received or placed.
D is the first seven digits of the number dialed.
Match Parameters for this Alarm Clue would be defined as
follows:
(A>18:00+A<07:00)*D=1------
Where:
(A>18:00+A<07:00)
Tells NetLink to count calls placed after
18:00 or before 07:00.
* is the logical AND operator.
D=1------ Tells NetLink to count calls where the first
digit of the number dialed is "1". Note that the
remaining 6 digits are entered as wild card
characters ( - ).
8-20
PollCat NetLink User's Guide
|19:18|067|R.JONES |OUT|12145551234 |25:36|04.75|
|19:20|092|J.SMITH |OUT|18008547226 |01:07|00.00|
|21:21|002|R.JONES |OUT|12135551212 |30:15|05.75|
-AAAAA-BBB-CCCCC------------DDDDDDD-----------EEEEE-------
Figure 8.8: Alarm Filter Format; Match Parameters Example 2