VMS secmon and Trigger Packet

Unanswered Question
May 25th, 2007
User Badges:

Right, in the network is a VMS Server 2.3sp2 and several 5.1.5E1s283.0 sensors. We have enabled the following commands on the sensors:


overrides produce-verbose-alert

override-item-status Enabled

risk-rating-range 50


SDEE events are received in VMS SecMon console. In the past with this enabled, when the Risk Rating was above 50 on any event received in the console, this would produce a (verbose) trigger packet that would be viewable on the console by right clicking the event and the selecting tools/trigger packet. However it seams that this is not the case anymore.


Could someone tell me if this function still works or has something changed that makes it not possible anymore?


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3.5 (2 ratings)
Loading.
rhermes Fri, 05/25/2007 - 08:44
User Badges:
  • Gold, 750 points or more

Check to see if you are still reporting Risk Ratings on your events in SecMon. We have had some senor updates break Risk Ratings. Re-importing the sensor in VMS fixes that problem.

darin.marais Wed, 05/30/2007 - 00:35
User Badges:

If I run show event on a sensor were I have enabled the commands:


overrides produce-verbose-alert

override-item-status Enabled

risk-rating-range 50


The event that is captured on the screen is as follows.


sensor# sh events


evIdsAlert: eventId=removed severity=high vendor=Cisco

originator:

hosted sensor

appName: sensorApp

appInstanceId: 5037

time: 2007/05/30 08:05:57 2007/05/30 10:05:57 CET

signature: description=Cursor/Icon File Format Buffer Overflow id=5442 version=S137

subsigId: 0

sigDetails: Malicious ANI File

interfaceGroup:

vlan: 0

participants:

attacker:

addr: locality=OUT removed

port: 8080

target:

addr: locality=OUT removed

port: 46531

context:

fromTarget:

text removed

fromAttacker:

text removed

riskRatingValue: 60

interface: ge2_0

protocol: tcp


The event includes the risk rating value. Is that what you mean?


In the past the events collected were IDIOM events but now the are SDEE. Is there a difference as far as the triggered packets are concerned. In the past the event included a section called triggerPacket but I don?t see that anymore.


Actions

This Discussion