Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Attack Description
Chapter 19: Auditing and Reporting
Auditing on the Sidewinder G2
policy violation all Detects attacks of all severities that violate the active
policy. This attack category also detects all severities of
failed authentication attacks, ACL and IP Filter deny
attacks, and Type Enforcement error attacks.
policy violation
severe
Detects severe attacks that violate the active policy. This
attack category also detects failed authentication attacks,
ACL and IP Filter deny attacks, and Type Enforcement
error attacks. Severe attacks indicate something is
occurring that an administrator should know.
power failure Detects when an Uninterruptible Power Supply (UPS)
device detects a power failure and the Sidewinder G2 is
running on UPS battery power.
protocol violation
all
protocol violation
severe
Detects attacks of all severities that violate protocol
compliance.
Detects severe attacks that violate proxy protocols (HTTP,
Telnet, FTP, etc.). Severe attacks indicate something is
occurring that an administrator should know.
proxy flood Detects potential connection attack attempts. A connection
attack is defined as one or more addresses launching
numerous proxy connection attempts to try and flood the
system. When NSS receives more connection attempts
than it can handle for a proxy, new connections to that
proxy are briefly delayed (to allow the proxy to “catch up”),
and the attack is audited.
spam filter failure Detects when an SMTP mail message is classified as
spam by the spam filtering policy.
syslog Detects all audit attacks and system events created via
syslog.
system all Detects all system events of all severities, including power
failures, hardware and software failures, failover events,
license expiration, host license exceeded, log overflows,
and IPSEC errors.
system critical Detects all critical system events, including power failures,
hardware failures, critical software failures, and failover
events. Critical system events indicate a component or
subsystem stopped working, that the system is going down
(expectedly or unexpectedly), or that the system is not
expected to work again without intervention.
More...
543