Attack Relevancy Rating

Unanswered Question
Aug 14th, 2009

What is the internal value of the Attack Relevancy Rating for the system with relevance=not-relevant. I do not see any difference for the system with relevance=unknown. In the attachment you will find the example of an attack? It is OK or not?

Looking forward ho hearing from you

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
mkodali Fri, 08/14/2009 - 05:34

value for ARR is adjusted as below :

- Unknown relevance : no change

- Relevant : +10

- Not-Relevant : -10 for promiscuous mode and no change for inline mode.

From the above adjustments sensor is behaving as it is supposed to be in your case. Since the risk ratings are same for system with not-relevant and unknown OS, looks like your sensor is in inline mode.

k.dmowski Fri, 08/14/2009 - 06:04


Thank you very much for your information

Best regards



This Discussion