Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 20: IPS Attack and System Event Responses
Creating IPS attack responses
568
Attack Description
IPFilter deny Detects when a connection is denied by the active IP Filter
policy.
keyword filter
failure
Detects when an SMTP mail message is rejected due to a
configured keyword filter.
mime virus Detects when a connection is rejected due to the MIME or
Anti-virus policy.
network probe Detects network probe attacks, which occur any time a
user attempts to connect or send a message to a TCP or
UDP port that has no service.
policy violation all Detects attacks of all severities that violate the active
policy. This attack category also detects all severities of
failed authentication attacks, network probe attacks, ACL
and IP Filter deny attacks, and Type Enforcement error
attacks.
policy violation
severe
protocol violation
all
protocol violation
severe
Detects severe attacks that violate the active policy. This
attack category also detects failed authentication attacks,
network probe attacks, ACL and IP Filter deny attacks, and
Type Enforcement error attacks. Severe attacks indicate
something is occurring that an administrator should know.
Detects attacks of all severities that violate protocol
compliance.
Detects severe attacks that violate proxy protocols (HTTP,
Telnet, FTP, etc.). Severe attacks indicate something is
occurring that an administrator should know.
proxy flood Detects potential connection attack attempts. A connection
attack is defined as one or more addresses launching
numerous proxy connection attempts to try and flood the
system. When NSS receives more connection attempts
than it can handle for a proxy, new connections to that
proxy are briefly delayed (to allow the proxy to “catch up”),
and the attack is audited.
spam filter failure Detects when an SMTP mail message is classified as
spam by the spam filtering policy.
TCP SYN attack Detects a possible attempt to overrun the Sidewinder G2
with connection attempts.
Type Enforcement Detects when there is a TE violation due to an
unauthorized user or process attempting to perform an
illegal operation.