Viavi Apex Enterprise G3-APEX-ENT-32T, Руководство пользователя

Страница: 235 / 380

Examining your network traffic with forensic analysis
Chapter 9: Forensic Analysis 235
be available from the right-click menu. You can also jump to the
Decode display of the packet that triggered the alert.
Creating a Forensic Settings profile
Forensics profiles provide a mechanism to define and load different pairings of
settings and rules profiles. Settings profiles define pre-processor settings that
let you tune performance; rules profiles define which forensic rules are to be
processed during analysis to catch threats against particular target operating
systems and web servers. Because Observer performs signature matching on
existing captures rather than in real time, its preprocessor configuration differs
from that of native Snort. When you import a set of Snort rules that includes
configuration settings, Observer imports rules classifications, but uses its own
defaults for the preprocessor settings.
Note: There is a difference between enabling the preprocessor and enabling
logs for the preprocessor. For example, you can enable IP defragmentation
with or without logging. Without logging, IP fragments are simply
reassembled; only time-out or maximum limit reached messages are noted
in the Forensics Log and in the Forensic Analysis Summary window. If
logging is enabled, all reassembly activity is displayed in the Forensics Log
(but not displayed in the Forensic Analysis Summary).
2. Click the Forensic Analysis tab.
3.
Right-click anywhere on the Forensic Analysis tab and choose Forensic
Settings from the menu. The Select Forensic Analysis Profile window opens.
4. Choose your profile and click Edit. The Forensic Settings window opens.
5. From the Forensic Settings window, complete the following:
●
Import Snort rules
●
Define Forensic Settings.
●
Define Rule Settings—Select the rules you want to enable.
6. Close all of the windows, then right-click anywhere on the Forensic Analysis
tab and choose Analyze from the menu.
applies the rules and filters to the capture data and displays the results in the
Forensics Summary tab.
The top portion of the Rules window lists the rules that were imported,
grouped in a tree with branches that correspond to the files that were
imported.
Rule classifications offer another level of control. Check the “Rules must also
match rule classifications” box to display a list of defined rule classifications.
Classifications are defined at import time by parsing the Snort config
classification statements encountered in the rule set. Rules are assigned a
classification in the rule statement’s classtype option.
Select the rule classification(s) you want to enable. If classification matching is
enabled, a rule and its classification must both be enabled for that rule to be
processed. For example, suppose you want to enable all policy violation rules:
simply right-click on the rule list, choose Enable all rules, and then enable the
policy violation classification.