OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
[ISSForum] custom responses and scripts w/ Server Sensor

From: CAUSEY, David (davidclmi.org)
Date: Wed Jul 06 2005 - 17:22:18 CDT

Has anyone had this problem...

I want to collect the IMPORTANT information from signatures such as WHO
DID IT! The canned email response in Server Sensor will email to you the
time, IP, event name, port (sometimes) but the part I really care about
is not an option. When an account gets locked, deleted, created, rights
change, a file is deleted, a service stopped, an admin acct had it's
password attempted a few times incorrectly, etc. I can have an email
response send me a useless email. Mine looks like this:

GMT: 2005-07-06 05:14:28 (-4 hours for EST)
DNS_Spoof_Success Severity: medium
Description: SuspiciousUDP
Sensor that Detected Traffic: 192.168.1.1 (SERVER1_Sensor)
Attacker IP: 192.168.1.2 Source Port: 53 (domain)
Destination: 192.169.100.30 Destination Port: 1044 UDP (Port# 1044)
Attack Successful? 2
User Name: N/A Resource ID: N/A Sub ID: N/A
Application: N/A

This is a bad example but at least you can see the template. Now in
signatures where an offenders name, IP, NETBIOS name, etc. apply I want
it in the email response. That info. *is* found in the Console. I can
see all the data I wanted to get such as user name, user's IP, user's
NETBIOS name, etc. but as far as I can tell that data cannot be included
in the standard email response. The only way I can figure is to design
custom scripts which do it.

Does anyone have this problem and, if so, how have you solved it?
Script? I wrote some tcl scripts to sort of do what I want and then a vb
script which emails it to me but it just seems like there's got to be a
better way.

Anyone??

David
_______________________________________________
ISSForum mailing list
ISSForumiss.net

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforumiss.net

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.