Symantec™ Security Gateways Reference Guide - Sawmill

392 IDS eventsSuspicious activityIdent Malformed DataBase Event:Details:Response:Affected:IDENT_BUFFER_OVERFLOWThe user name in an ident response was longer than 16 bytes. While not a violation of the protocol,this is suspicious and may indicate a compromised ident server.If seen in sufficient volume or variation, audit of client and server is recommended.No specific targets.False Positives: It is possible this is a non-compliant ident implementation.ReferencesIdent SpecificationsIdent Malformed DataBase Event:Details:Response:Affected:IDENT_DATA_PAST_CLOSEExtra data was detected in an ident exchange (data past the end of a valid protocol exchange). Thismay indicate a compromised ident server.If seen in sufficient volume or variation, audit of client and server is recommended.No specific targets.False Positives: It is possible this is a non-compliant ident implementation.ReferencesIdent SpecificationsIdent Malformed DataBase Event:Details:Response:Affected:IDENT_DATA_PAST_REQUESTData was detected after the end of a valid ident request. This may indicate a compromised identserver.If seen in sufficient volume or variation, audit of client and server is recommended.No specific targets.False Positives: It is possible this is a non-compliant ident implementation.ReferencesIdent SpecificationsIMAP Failed LoginBase Event:Details:IMAP_FAILED_LOGINA failed IMAP authentication attempt was detected.IMAP Protocol ViolationBase Event:Details:IMAP_CLI_ENCRYPTED_OR_INVALID_AUTH_OR_BASE64Invalid IMAP client side auth/base64 or using encrypted connection.IMAP Protocol ViolationBase Event:Details:IMAP_CLI_INVALID_ASTRING_CRLFThe IMAP exchange expected an “astring” followed by a CRLF, but was sent something else.