DeepSight Analyzer Update

"Oliver Friedrichs" <[email protected]> Thu, 8 Aug 2002 16:25:02 -0700
Newsgroups gmane.comp.security.aris
Message-ID <C8396509CAD720478B0C8F723C8676A61D9C7F@hadies.sanmateo.securityfocus.com>
Hi Everyone,

Tonight we will be rolling out a new "Statistics" page on the DeepSight
Analyzer system.  This statistics page will summarize the event activity
being observed by your sensors by a number of different categories on a
single screen.  These categories include:

- Top increasing IDS events - A set of graphs depicting the=20
  events that are seeing the most significant increase on your network

- Top increasing Port activity - A set of graphs depicting the ports=20
  that are seeing the most signficant increase on your network

- Top attacked products - The top products being targetted on your
network

- Top offending ISPs - The top ISPs from which events targetting your
network=20
  originate

- Top ports - The top ports your sensors are observing activity on

- Top source IPs - The top source IP addresses from which your sensors
are=20
  observing activity

- Top countries - The top sources countries from which your sensors are=20
  observing activity

The majority of these items will also allow you to drill down to view
specific events associated with these items.

As always, we welcome any feedback.  Please feel free to contact me
directly,

Oliver Friedrichs
Sr. Manager - DeepSight
(650) 375-5331