24
©
SOLIDA SYSTEMS INTERNATIONAL
2016
7.2.1 Low severity (colored green in the GUI)
These events are typically generated by trying to visit known phishing sites, or sites containing
various types of malware. The appliance will automatically drop these network packets. This will
prevent malware from infecting the protected network.
These events require no further action from the user.
7.2.2 Medium severity (colored orange in the GUI)
Events with a medium severity rating include known C2 domains, domains with severe drive-by
malware, Trojans and more. Network packets destined to these domains will be automatically
dropped, in an effort to maintain network integrity.
These events require no further action from the user.
7.2.3 Critical severity (colored red in the GUI)
Critical events will be generated if the appliance detects malicious activities occurring inside the
network. This would indicate the network has been compromised. Where malware is already
present that requires user intervention to remove. Examples of such events are DNS queries
generated by a ransomware DGA engine, or malwares trying to connect with a C2 server.
All network packets resulting in critical events will be automatically dropped, to mitigate further
infection to the network. The event includes the source and destination IP addresses of the
offending packets. Which allows for prompt identification of the infected computer on the
network. The user will be required to remove the malware from the infected computer using a
suitable removal tool.
All events can be viewed using the monitor application, included with the appliances. Optionally,
emails containing the event count and severity can be automatically generated and sent out. A
mobile phone application is also available, that allows the user to monitor events in real time.
7.3 Source and Destination IP Addresses
Each rule event includes the source and destination IP addresses, of the packet that generated the
rule hit. Logging these IP addresses allows for a more detailed examination of the source of the
threat. The Internet offers many “whois” services where an IP address can be entered for analysis.
This information also includes geographical information regarding an IP address.
