Hi All,
I collected the raw logs of Realsecure Network sensor IDS from
EventCollector.
But, I was not able to understand the log content.
It has more fields each separated by comma delimiter.
Certain fields start with "R|", "SP|" and "AP|", what this
implies?
Few fields can be understood. But some fields are not able to
guess, for example: R|AlertFormatVersion, R|AlertNameType,
R|AlertTimePrecision, R|AlertTimeSequenceID, R|AlertID, R|ProductID,
R|AlertType, R|AlertPriority, R|AlertFlags, SP|Algorithm-id,
SP|ResponseList, SP|IANAProtocolID, SP|VulnStatus, AP|:reason, etc. What
these fields imply?
How can I get more information about each field present in the
IDS logs?
Please tell me someone more information on this.
Cheers,
Jagadeeshan S
DISCLAIMER:
Information transmitted by this e-mail may be proprietary to Ramco Systems
Ltd., and / or the authors of the information and is intended for use only by
the individual or entity to which it is addressed, and may contain confidential
or legally privileged information. If you are not the intended recipient or it
appears that this mail has been forwarded to you without proper authority, you
are not authorised to access, read, disclose, copy, use or otherwise deal with
it and any such actions are prohibited and may be unlawful.
Internet communications cannot be guaranteed to be secure or error-free as
information could be intercepted, corrupted, lost, arrive late or contain
viruses. Ramco Systems Limited therefore does not accept liability for any
errors, omissions, viruses or computer problems experienced as a result of this
transmission.
If you have received this e-mail in error, please notify us immediately at mail
to: [EMAIL PROTECTED] and delete this mail from your records. Notice is hereby
given that no representation, contract or other binding obligation shall be
created by this e-mail.
_______________________________________________
ISSForum mailing list
[email protected]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to [EMAIL PROTECTED]
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
