08-14-2009 03:06 AM - edited 03-10-2019 04:44 AM
What is the internal value of the Attack Relevancy Rating for the system with relevance=not-relevant. I do not see any difference for the system with relevance=unknown. In the attachment you will find the example of an attack? It is OK or not?
Looking forward ho hearing from you
08-14-2009 05:34 AM
value for ARR is adjusted as below :
- Unknown relevance : no change
- Relevant : +10
- Not-Relevant : -10 for promiscuous mode and no change for inline mode.
From the above adjustments sensor is behaving as it is supposed to be in your case. Since the risk ratings are same for system with not-relevant and unknown OS, looks like your sensor is in inline mode.
08-14-2009 06:04 AM
Hi
Thank you very much for your information
Best regards
Kazimierz
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide