Daily Intrusion Prevention System Dashboard

Daily Intrusion Prevention System Dashboard dimanche mars 7, 2010
IPS - Computers Targeted by and Sending Potential Threats
Top Computer Targetted
Number of Computers
Internal Target of Internal Threats 192.168.0.201
9
Internal Target of Inbound Threats 192.168.0.92
3
External Target of Outbound Threats nsp-fi1.interbusiness.it(85.37.17.5)
Top Source Computer
4
Number of Computers
Internal Source of Internal Threats 192.168.0.52
6
External Source of Inbound Threats 207.46.104.20
59
Internal Source of Outbound Threats 192.168.0.92
1
IPS Filtered Traffic - Hourly Activity
Inbound
Internal
Accepted:
Number of Hits:
Blocked:
Number of Hits:
65
1
Accepted:
Number of Hits:
Blocked:
Number of Hits:
146
37
IPS Filtered Traffic - Flow
Accepted
Inbound
65
Blocked
1
Total
66
Outbound
Accepted:
Number of Hits:
Blocked:
Number of Hits:
26
Outbound
Internal
26
146
37
26
183
IPS - Top 5 Potential Threats
Short Description Severity Events
SMB.DCERPC.Registry.OpenHKLM.139 1 108
edonkey 1 48
SMB.DCERPC.NetRemoteTOD.445 1 26
CyberKit.2.2 1 21
SMB.DCERPC.SamrEnumerateAliasesInDomain.139 1 21
Total Top 5 Attacks
224
IPS - Top 5 Services Targeted by Potential Threats
Total
139
1 129 130
445
33 33
53
25 25
0
1 21 22
3843
10 10
Total Top 5 Services: 12 25 183 220
Report printed on lundi mars 8, 2010 at 15:41 Dashboard created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 1/19

Events by Hour of the Day - Graph dimanche mars 7, 2010
Accepted Traffic
Blocked Traffic
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 2/19

Events by Hour of the Day - Data
dimanche mars 7, 2010
Hour
Inbound Outbound Internal
Total Hits
Accepted Blocked Accepted Blocked Accepted Blocked Accepted Blocked Total
00:00 4
4
01:00 4
4
02:00 4
4
03:00 2
2
04:00 4 5
4
05:00 6
6
06:00 2
2
07:00 4
4
08:00 4
4
09:00 2 4
6
10:00 4 2
4
11:00 6
6
12:00 5 2
5
13:00 4
4
14:00 3 10
13
15:00 6 11 2
17
16:00 50 23 9 3
82
17:00 4 10 2
14
18:00 12 10
12
19:00 3 1 19 11
22
20:00 6
6
21:00 4
4
22:00 4
4
23:00 4
4
Total for dimanche mars 7, 2010 65 1 26 146 37
237
38
275
5
2
2
2
3
2
10
12
4
4
4
2
9
6
2
4
4
6
6
6
7
4
13
19
85
16
22
34
6
4
4
4
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 3/19

Top 25 Attacks - Graph dimanche mars 7, 2010
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 4/19

Top 25 Attacks - Data
dimanche mars 7, 2010
Attack Category
Attack Name
Severity
Total Attacks
netbios SMB.DCERPC.Registry.OpenHKLM.139 1 - High
p2p edonkey 1 - High
netbios SMB.DCERPC.NetRemoteTOD.445 1 - High
icmp CyberKit.2.2 1 - High
netbios SMB.DCERPC.SamrEnumerateAliasesInDomain.139 1 - High
im msn 1 - High
dns_decoder invalid_param 1 - High
dns_decoder invalid_pointer 1 - High
netbios SMB.DCERPC.SamrEnumerateAliasesInDomain.445 1 - High
dns_decoder invalid_opcode 1 - High
anomaly udp_src_session 1 - High
Denial of Service Microsoft.Works.Spreadsheet.Memory.Corruption 1 - High
web-misc Prozilla.Location.BufferOverflow 1 - High
netbios NT.NULL.Session 1 - High
Total for the above list:
108
48
26
21
21
15
11
10
7
4
1
1
1
1
275
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 5/19

Top 25 Attacks by Severity Level
dimanche mars 7, 2010
Severity Level
Attack Category Potential Attack Description
Flux
Number of Potential Attacks
1 - High
Total for the above list:
netbios SMB.DCERPC.Registry.OpenHKLM.139
Internal
108
p2p edonkey
Inbound
48
netbios SMB.DCERPC.NetRemoteTOD.445
Internal
26
icmp CyberKit.2.2
Internal
21
netbios SMB.DCERPC.SamrEnumerateAliasesInDomain.139
Internal
21
im msn
Inbound
15
dns_decoder invalid_param
Outbound
11
invalid_pointer
Outbound
netbios SMB.DCERPC.SamrEnumerateAliasesInDomain.445
Internal
7
dns_decoder invalid_opcode
Outbound
4
anomaly udp_src_session
Outbound
1
Denial of Service Microsoft.Works.Spreadsheet.Memory.Corruption
Inbound
1
web-misc Prozilla.Location.BufferOverflow
Inbound
1
netbios NT.NULL.Session
Inbound
1
275
10
275
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 6/19

Top 25 Blocked Attacks - Graph dimanche mars 7, 2010
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 7/19

Top 25 Blocked Attacks - Data
dimanche mars 7, 2010
Attack Category
Attack Name Severity Flux
Total Attacks
netbios SMB.DCERPC.SamrEnumerateAliasesInDomain.139 1 - High Internal
icmp CyberKit.2.2 1 - High Internal
Denial of Service Microsoft.Works.Spreadsheet.Memory.Corruption 1 - High Inbound
Total for the above list:
20
17
1
38
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 8/19

Top 5 Internal Computer(s) Targeted by the Top 5 Internal Threats dimanche mars 7, 2010
Internal Computer Targeted
Threat Category
Potential Threat Description
Number of Potential Threats
192.168.0.201
192.168.0.52
192.168.0.249
192.168.0.204
192.168.0.3
Total for the above list:
netbios SMB.DCERPC.Registry.OpenHKLM.139
108
SMB.DCERPC.SamrEnumerateAliasesInDomain.139
netbios SMB.DCERPC.NetRemoteTOD.445
26
SMB.DCERPC.SamrEnumerateAliasesInDomain.139
SMB.DCERPC.SamrEnumerateAliasesInDomain.445
icmp CyberKit.2.2
1
icmp CyberKit.2.2
8
netbios SMB.DCERPC.SamrEnumerateAliasesInDomain.139
4
icmp CyberKit.2.2
3
icmp CyberKit.2.2
7
114
6
42
8
7
8
7
7
178
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 9/19

Top 5 Internal Computer(s) Targeted by the Top 5 Inbound Threats
dimanche mars 7, 2010
Internal Computer Targeted
Threat Category
Potential Threat Description
Number of Potential Threats
192.168.0.92
192.168.0.52
192.168.0.3
Total for the above list:
p2p edonkey
48
im msn
12
im msn
3
netbios NT.NULL.Session
1
web-misc Prozilla.Location.BufferOverflow
1
Denial of Service Microsoft.Works.Spreadsheet.Memory.Corruption
1
60
5
1
66
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 10/19

Top 5 External Computer(s) Targeted by the Top 5 Outbound Threats
dimanche mars 7, 2010
External Computer Targeted
Threat Category
Potential Threat Description
Number of Potential Threats
nsp-fi1.interbusiness.it(85.37.17.5)
nsp-mi2.interbusiness.it(85.37.17.4)
202.98.116.66
80.179.198.162.cable.012.net.il(80.179.198.162)
dns_decoder invalid_param
6
invalid_opcode
invalid_pointer
dns_decoder invalid_pointer
8
invalid_param
dns_decoder invalid_param
1
anomaly udp_src_session
1
12
4
2
12
4
1
1
Total for the above list:
26
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 11/19

Top 5 Internal Computer(s) Sending the Top 5 Internal Threats dimanche mars 7, 2010
Internal Computer Sending Threats
Threat Category
Potential Threat Description
Number of Potential Threats
192.168.0.52
192.168.0.53
192.168.0.82
192.168.0.87
192.168.0.56
Total for the above list:
netbios SMB.DCERPC.Registry.OpenHKLM.139
108
icmp CyberKit.2.2
20
netbios SMB.DCERPC.SamrEnumerateAliasesInDomain.139
13
netbios SMB.DCERPC.NetRemoteTOD.445
26
SMB.DCERPC.SamrEnumerateAliasesInDomain.445
SMB.DCERPC.SamrEnumerateAliasesInDomain.139
netbios SMB.DCERPC.SamrEnumerateAliasesInDomain.139
6
netbios SMB.DCERPC.SamrEnumerateAliasesInDomain.445
2
icmp CyberKit.2.2
1
141
32
5
1
6
2
1
182
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 12/19

Top 5 External Computer(s) Sending the Top 5 Inbound Threats dimanche mars 7, 2010
External Computer Sending Threats
Threat Category
Potential Threat Description
Number of Potential Threats
207.46.104.20
ns20286.ovh.net(213.251.133.129)
0x503e1df8.bynxx8.dynamic.dsl.tele.dk(80.62.29.248)
131.Red-81-36-215.dynamicIP.rima-tde.net(81.36.215.131)
188.28.185-80.rev.gaoland.net(80.185.28.188)
Total for the above list:
im msn
7
p2p edonkey
2
p2p edonkey
1
p2p edonkey
1
p2p edonkey
1
7
2
1
1
1
12
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 13/19

Top 5 Internal Computer(s) Sending the Top 5 Outbound Threats dimanche mars 7, 2010
Internal Computer Sending Threats
Threat Category
Potential Threat Description
Number of Potential Threats
192.168.0.92
Total for the above list:
dns_decoder invalid_param
11
invalid_pointer
invalid_opcode
anomaly udp_src_session
1
26
10
4
26
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 14/19

Top 5 External Computers with the Top 5 Inbound Threat Detailed Results
dimanche mars 7, 2010
External Computer
Sending Threats
Internal Target Computer Service Threat Category Potential Threat Description
Action
Number of
Threats
207.46.104.20
7
192.168.0.92 3007 im msn
Accepted
4
192.168.0.52 1600
msn Accepted
1
192.168.0.92 4413
msn Accepted
1
192.168.0.92 3225
msn Accepted
1
ns20286.ovh.net(213.251.133.129)
2
192.168.0.92 3844 p2p edonkey
Accepted
1
192.168.0.92 3746
edonkey Accepted
1
0x503e1df8.bynxx8.dynamic.dsl.tele.dk(80.62.29.248)
1
192.168.0.92 4060 p2p edonkey
Accepted
1
131.Red-81-36-215.dynamicIP.rima-tde.net(81.36.215.131)
1
192.168.0.92 4321 p2p edonkey
Accepted
1
188.28.185-80.rev.gaoland.net(80.185.28.188)
1
192.168.0.92 4160 p2p edonkey
Accepted
1
Total for the above list:
12
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 15/19

Top 5 Internal Computers with the Top 5 Outbound Threat Detailed Results
dimanche mars 7, 2010
Internal Computer
Sending Threats
External Target Computer Service Threat Category Potential Threat Description
Action
Number of
Threats
192.168.0.92
nsp-mi2.interbusiness.it(85.37.17.4)
nsp-fi1.interbusiness.it(85.37.17.5)
nsp-fi1.interbusiness.it(85.37.17.5)
nsp-mi2.interbusiness.it(85.37.17.4)
nsp-fi1.interbusiness.it(85.37.17.5)
Total for the above list:
53
53
53
53
53
26
dns_decoder invalid_pointer
Accepted
8
invalid_param Accepted
6
invalid_opcode Accepted
4
invalid_param Accepted
4
invalid_pointer Accepted
2
26
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 16/19

Top 5 Internal Computers with the Top 5 Internal Threat Detailed Results
dimanche mars 7, 2010
Internal Computer
Sending Threats
Internal Target Computer Service Threat Category Potential Threat Description
Action
Number of
Threats
192.168.0.52
192.168.0.53
192.168.0.82
192.168.0.87
192.168.0.56
141
192.168.0.201 139 netbios SMB.DCERPC.Registry.OpenHKLM.139
Accepted 108
192.168.0.201 139
SMB.DCERPC.SamrEnumerateAliasesInDomain.139 Blocked
6
192.168.0.249 0
icmp CyberKit.2.2
Blocked
6
192.168.0.3 0
CyberKit.2.2 Blocked
5
192.168.0.204 139 netbios SMB.DCERPC.SamrEnumerateAliasesInDomain.139 Blocked
4
32
192.168.0.52 445 netbios SMB.DCERPC.NetRemoteTOD.445
Accepted
26
192.168.0.52 445
SMB.DCERPC.SamrEnumerateAliasesInDomain.445 Accepted
5
192.168.0.52 139
SMB.DCERPC.SamrEnumerateAliasesInDomain.139 Blocked
1
6
192.168.0.52 139 netbios SMB.DCERPC.SamrEnumerateAliasesInDomain.139 Blocked
5
192.168.0.52 139
SMB.DCERPC.SamrEnumerateAliasesInDomain.139 Accepted
1
2
192.168.0.52 445 netbios SMB.DCERPC.SamrEnumerateAliasesInDomain.445 Accepted
2
1
192.168.0.52 0
icmp CyberKit.2.2
Blocked
1
Total for the above list:
182
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 17/19

IPS Potential Threat Categories Detected - Graph
dimanche mars 7, 2010
Top 5 Threat Categories Detected Sorted by the Total Number of Potential Threats.
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 18/19

Top 5 Threat Categories Detected with their Top 5 Threats
dimanche mars 7, 2010
Threat Category
Signature
Potential Threat Description
Inbound
Internal
Outbound
Total Threats
netbios
p2p
dns_decoder
icmp
im
FGT102039613 SMB.DCERPC.Registry.OpenHKLM.139
108
108
FGT102039615 SMB.DCERPC.NetRemoteTOD.445
26
26
FGT102039618 SMB.DCERPC.SamrEnumerateAliasesInDomain.139
21
21
FGT102039619 SMB.DCERPC.SamrEnumerateAliasesInDomain.445
7
7
FGT102039558 NT.NULL.Session
1
1
FGT109051907 edonkey
48
48
FGT8912909 invalid_param
11
11
FGT8912898 invalid_pointer
10
10
FGT8912906 invalid_opcode
4
4
FGT17956877 CyberKit.2.2
21
21
FGT108855298 msn
15
15
1
48
15
162
21
25
163
48
25
21
15
Total for the above list: 64
183
25
272
Report printed on lundi mars 8, 2010 at 15:41 Report created with Click&DECiDE Builder
Powered by © Click&DECiDE Page 19/19