About lewko98

lewko98 · 09-10-2008

Ok, I am not sure how this is happening but here is my issue. Currently I setup notifications via email alerts whenever a certain rule fires. The issue I am having is that I am getting an e-mail alert for a rule that I cannot find. I am looking under...

lewko98 · 08-21-2008

Hello all, I am having some trouble understanding the built in rules for Mars. When doing a ping scan on my network the rule for Worm Propagation fires, can anybody explain why? the rule and example info is below:***********************************...

lewko98 · 08-21-2008

Hello All, I am having trouble understanding the different Event Type Groups used in the different Mars Rules. For example When Looking throught incidents generated I foundport Scansping sweeps server scans for specific ports and othersthat are all ...

lewko98 · 09-12-2008

... you know what.. I dont think I did. I didnt think to hit the activate button after saving changes, your probably right!

lewko98 · 09-11-2008

mhellman, thanks for all of your help. However the fix to my issue of this "ghost rule notifications" was a reboot to mars, now I get the right notifications, and no longer see the notification from the unfindable rule. I appreciate your time though...

lewko98 · 09-11-2008

In the incident queue I cannot click on the rule. On the rule tab under the inactive rules, in the all group, I can find the rule that I duplicated but not the original( example I am looking for "rule a", I cant find it but I can find "rule a - copie...

lewko98 · 09-11-2008

mhellman, you are correct, the link to the incident in the email contains the rule, and that's the rule I cannot find. When on the inspection rule tab, I have checked under user, and couldn't find it, I have also checked under the all group and cant...

lewko98 · 09-10-2008

In most of my cases (if not all) it is not p2p software but a scan against my network. There is no discrimination if the rule is alerting from traffic coming from an internet machine to my network, or my machine going out to the internet, so the rule...

Member Since	‎08-21-2008 06:03 AM
Date Last Visited	‎08-18-2017 03:53 AM
Posts	11

User Statistics

User Activity

Rule alerting, but I cant find the rule

ping scan triggers System Rule: Worm propagation attempts?

Event Type Groups / Rule behavior

Re: Rule alerting, but I cant find the rule

Re: Rule alerting, but I cant find the rule

Re: Rule alerting, but I cant find the rule

Re: Rule alerting, but I cant find the rule

Re: ping scan triggers System Rule: Worm propagation attempts?