Viewing Advisor Data

Advisor provides a cross-reference between real-time IDS attack signatures and Advisor's knowledge base of vulnerabilities. Advisor feed has an alert and attack feed. The alert feed contains information about vulnerabilities and viruses. The attack feed lists the exploits associated with vulnerabilities.

The supported Intrusion Detection Systems are:

      • Cisco Secure IDS

      • Enterasys Dragon Host Sensor

      • Enterasys Dragon Network Sensor

      • ISS BlackICE PC Protection

      • ISS RealSecure Desktop

      • ISS RealSecure Network

      • ISS RealSecure Server Sensor

      • ISS RealSecure Guard

      • Snort/Sourcefire

      • Symantec ManHunt

      • Symantec Intruder Alert

      • McAfee IntruShield

The IDS Collector populates the DeviceAttackName (rt1) field of an event. Advisor uses this information to generate attack and vulnerability information. Some examples of vulnerabilities are:

      • FINGER: Cfinger Search Probe

      • SMTP: SmartServer3 MAIL FROM Buffer Overflow

      • HTTP: Dragon Fire IDS Web Interface Remote Execution

      • FTP:MKDIR-DOS

      • hp-printer-flood

      • wh00t-backdoor

      • nt-telnet

      • FINGER / execution attempt

      • tellurian-tftpdnt-filename-bo

      • FTP MKD Stack Overflow

To View Advisor Data:

  1. In a Real Time Event Table of the Visual Navigator or Snapshot, right-click an event or a series of selected events>Analyze>Advisor Data. If the DeviceAttackName field is properly populated, a report similar to the one below will appear. This example is for a WEB-MISC amazon 1-click cookie theft.

image\ebx_-1352714966.gif