Editing Security information and event management (SIEM)
Jump to navigation
Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 18: | Line 18: | ||
| Repeat Attack-Host Intrusion Prevention System || Find hosts that may be infected or compromised (exhibiting infection behaviors) || Alert on 3 or more events from a single IP Address in 10 minutes || Host Intrusion Prevention System Alerts | | Repeat Attack-Host Intrusion Prevention System || Find hosts that may be infected or compromised (exhibiting infection behaviors) || Alert on 3 or more events from a single IP Address in 10 minutes || Host Intrusion Prevention System Alerts | ||
|- | |- | ||
− | | Virus Detection/Removal || Alert when a virus, spyware or other malware is detected on a host || Alert when a single host sees an identifiable piece of malware || Anti-Virus, | + | | Virus Detection/Removal || Alert when a virus, spyware or other malware is detected on a host || Alert when a single host sees an identifiable piece of malware || Anti-Virus, HIPS, Network/System Behavioral Anomaly Detectors |
|- | |- | ||
| Virus or Spyware Detected but Failed to Clean || Alert when >1 Hour has passed since malware was detected, on a source, with no corresponding virus successfully removed || Alert when a single host fails to auto-clean malware within 1 hour of detection || Event Sources: Firewall, NIPS, Anti-Virus, HIPS, Failed Login Events | | Virus or Spyware Detected but Failed to Clean || Alert when >1 Hour has passed since malware was detected, on a source, with no corresponding virus successfully removed || Alert when a single host fails to auto-clean malware within 1 hour of detection || Event Sources: Firewall, NIPS, Anti-Virus, HIPS, Failed Login Events |
Advertising: