IDS Sensor
- Inputs from live network or libpcap format files
- Packet reassembly
- Session analysis
- Statistics collection
- Dynamical rule updates
- Support for IPv4 and IPv6
- Supports encrypted sessions with database interface
- Automatic log rotation
- Automated application recovery
Database
- Automated creation and initialization
- Administered from user interface
- Database auditing of activity including:
- User login and logout
- Host, Site, and Point of Contact changes
- Rule Defintion changes
- Incident Report creation or update
- Database performance optimized during installation
- Support for encrypted sessions
Database Interface
- Transfers both data and control information between IDS sensors
and the database
- Interfaces to multiple IDS sensors
- Automatically maintains sessions with IDS sensors
- Supports encrypted sessions
- Automatic log rotation
User Interface
- Administration of IDS sensors, including site and point of
contact information for them
- Manage the database, including:
- Import rules from SQL scripts, as well as executing
SQL scripts for other database updates
- Remove incidents closed without a report from the database
- Check user status, including forcing user logoff
- Manage rules in the user interface, which includes the
following features:
- Extensive syntax checking as rules are defined
- Extensive context checking for rules to help insure their
correct execution
- Export rules to IDS sensors without losing session data
- Display incident reports in Analysis Tab and allow sorting on
many fields
- Display session data of reported incidents using the following
features:
- Display both halves of session data
- Display session packet headers
- Display data as Unicode in the playback windwo
- Find highlighted Triggers in the playback window
- Find text in the playback window
- Decode hexadecimal values in the playback window
- Manaage Incident Reports for tracking trends:
- Maintain site specific comments for Incident Reports
- Create multiple reports by copying from an existing report
- Display Site information for the sensor that reported an
incident
- Track Trends:
- Use the Trends tab to search for trends in Incidents or
Incident Reports
- Use the Reports tab to output pre-defined reports for
Incidents and Incident Reports
- Use the Statistics tab to output pre-defined reports
for Statistics
- Online help with the capability to add Reference information
specific to the site
|
