Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Example 2: Filtering for services and users
Chapter 19: Auditing and Reporting
Auditing on the Sidewinder G2
The following example shows the format used to display HTTP network traffic
audit records for a user named Lloyd:
type t_attack and cmd httpp and username Lloyd
where:
• type t_attack — This field will filter audit records for all attack events.
• cmd httpp — This field will filter the attack audit events to include only
HTTP service records.
• username Lloyd — This field will filter the HTTP attack events to include
only events that are specific to actions performed by user name “Lloyd.”
Example 3: Filtering for specific ports and IP addresses
The following example shows the format used to display all network probe
events on port 37337 and subnet 192.168.124.0/24 originating from burbs
3 or 4. Enter text on one line:
type t_netprobe and dst_port 37337 and dst_ip 192.168.124.0/
24 and (src_burb 3 or src_burb 4)
where:
• type t_netprobe — This field will filter audit records for all network probe
events.
• dst_port 37337 — This field will filter the network probe events to include
only records with a destination port of 37337.
• dst_ip 192.168.124.0/24 — This field will filter the network probe events to
include only records with a destination IP address of 192.168.124.0/24.
• (src_burb 3 or src_burb 4) — This information will filter the network probe
events to include only records with a source burb of 3 or 4.
Example 4: Excluding information in a filter
You can explicitly exclude certain types of audit information by placing the word
“not” in front of a field. For example, the custom filter shown below will display
all audit records EXCEPT attack records originating for the source IP address
172.17.9.28:
not type t_attack and src_ip 172.17.9.28
where:
• not type t_attack — This field will exclude any attack-based audit events.
• src_ip 172.17.9.28 — This field will filter the non-attack audit events for
records with a source address of 172.17.9.28.
545