Enterasys Intrusion Prevention System, Руководство по отчетности, Страница: 108 / 122

Using the Forensics Console Legacy Reporting
11-20 Enterasys IPS Analysis and Reporting Guide
As tools are selected, different filtering options are enabled or disabled in the filter buttons.
4. Click Date in the left navigation area.
The date pulldown appears in the display area.
5. Select the desired log file date for which you want the selected tool to apply.
6. Select the desired filter buttons.
Filtering options are dynamic and vary for each tool selected. As URLs are generated in the
reporting content in the display area, the filtering options are updated. For example, if you
start with a sum_event report, and click on an event name, you are taken to a mklog report.
The mklog report now includes a filter update that indicates which event was filtered.
As you drill down from report to report, you can modify the current filtering rule. You can
remove a filter for a specific port, or change a specific IP address to a more generic CIDR
block.
Selecting a new tool clears all current dynamic filters.
7. Click execute .
The display area is populated with the requested data.
The following figures provide two sample reports. Figure 11-22 is an example output of the
sum_event tool. Figure 11-23 shows the sum_event tool options used to select the desired
output format.
mksession Reconstructs TCP and UDP sessions from IP packets collected. Also lists times, IP
addresses, and ports of active sessions in a dragon.db file.
When a partial list of matching sessions is displayed, the number of packets present in each
session is indicated. Clicking on this number replays that unique session.
If source and destination IP addresses and source and destination ports are selected, a
reconstruction of that particular session is attempted. Otherwise, a list of potentially
matching sessions is displayed which can then be selected for display.
mkalarm Scores each active IP address in dragon.db based on the amount of events and the
seriousness of each event.
mkicmp Searches for events from Dragon Network Sensors that contain ICMP packets. The tool
can sort based on ICMP type and code, and print out a hash of the randomness of the
ICMP payload which is key in detecting active ICMP based backdoors.
mkchart Provides an ASCII chart that breaks out the number of events that have occurred against a
range of IP addresses.
Clicking on a particular event number launches a mklog report filtered on the particular IP
address and event name.
A CIDR block must be entered into the hosts filter with a last octet of zero. For example, to
chart a CIDR block of 10.100.100.0/24, an IP address of 10.100.100.0 must be added.
mktime Provides a 24-hour ASCII chart of time versus events. This is useful for identifying peak
activity periods such as DoS attacks or brute force attacks.
Selecting any hourly bar chart produces a sum_event report of all events plus or minus 15
minutes of the time selected.
mkports Provides a chart listed by UDP and TCP ports.
Table 11-2 Forensics Tools (Continued)
Forensics
Tool
Description