Enterasys Intrusion Prevention System, Руководство по отчетности

Страница: 107 / 122

Legacy Reporting Using the Forensics Console
Enterasys IPS Analysis and Reporting Guide 11-19
Figure 11-21 Dragon Forensics Console Tool
2. Click Tool in the left navigation area.
The tool pulldown menu appears in the display area.
3. Select the desired tool from the tool pulldown.
Table 11-2 Forensics Tools
Forensics
Tool
Description
sum_event Produces a list of each unique event types detected, the number of the events which have
occurred, and a 24-hour time line marking the hours where each event has occurred. Many
sorting options are available such as sorting based on CIDR blocks, event groups and
direction.
In the 2D-bar chart mode, clicking on a group name displays a list of events associated with
the group of events.
In the list or direction output modes, clicking on a unique event name produces a mklog
report.
sum_ip Produces a list of unique IP addresses or CIDR blocks that have occurred in a 24-hour
period. The tool can filter based on direction, event types, and many other parameters.
sum_db Reports high level statistics on a dragon.db file such as the number of events, a break-out
of stats for each Dragon Network Sensor or Dragon Host Sensor, and bytes of data stored.
mklog Produces a hex dump of events.
Clicking on IP addresses produces a new mklog report with the IP address as a filter.
Clicking on an event name produces a new mklog report with the event name as a filter.
Clicking on a source or destination port launches a mksession tool with the intent of
reconstructing the session associated with the event. The maximum amount of events
listed can be selected from a pulldown menu in the output mode filter.