risk manager '[ u'[ y'e k c...

Tivoli®

Risk Manager ��

�� 3 �� 8GC88-8881-01

(Q865'GC32-0703-01)

xn"=(

Copyright © 2000, 2001 IBM Corporation. All rights reserved. Tivoli Systems Software License Agreement"IBM Wm0i

`N4HQrob7/OHQ@sro^?O3liKP9k Tivoli =JNi$;s9psb7/OC'K-\NroK7

?,CFN_"3N8qrHQ9k3H,G-^9#$+JkA0^?OjJ (ER*"!#*"'$*"wX*"JX

*"j0^?O=N>NA0&jJr^`#) G"CFb"Tivoli Systems RNqLKhkv0NvzJ7K"\qN$+

Jkt,b"#="w."#L"!w79F`XN-?"^?O$UN3sTe<?<@lXNQ9rT&3HOG-^

;s# Tivoli Systems RO"*RM4+H,HQ9k\*GO<I3T<^?O!#DID=J8qN#=*rn.9k

)B5l?"xrvz7^9,"=N#=*KO9YF"Tivoli Systems RNxn"=(rU9kbNH7^9#xn"K

pE/=N>N"xO"Tivoli Systems RNqLKhkv0NvzJ7KU?5lk3HO"j^;s#3N8qO"8:

*JHQrU^7F*i:"$+Jk]ZbJ7KCj*H7F=89k^^NuVGs!5l^9#

3N8qKO"&J-N]Z"Cj\*,g-N]Z*hS!'eNlS4]U$r^a"$+Jk]Zb,Q5l^;

s#

Fq/\!Xf<6<N"xN)B = IBM Corporation HNVN GSA ADP Schedule Contract Khj"HQ"#="*

hS+(,)B5l^9#

&8

IBM"AIX"DB2"FirstSecure"OS/2"RS/6000"SecureWay"Tivoli"Tivoli Management Environment"TME 10 Enterprise

Console"TME Framework"*hS TME 10 O"IBM Corporation N&8G9#

Microsoft"Windows"Windows NT"*hS Windows m4O"Microsoft Corporation NFq*hS=N>NqK*1k&

8G9#

UNIX O"The Open Group ,i$;s97F$kFq*hS=N>NqK*1kP?&8G9#

Java *hS9YFN Java X"N&8*hSm4O" Sun Microsystems, Inc. NFq*hS=N>NqK*1k&8^?

OP?&8G9#

>NqR>"=J>*hS5<S9>JIO=l>lFRN&8^?OP?&8G9#

C-v`

\qK*$F"Tivoli Systems ^?O IBM =J"Wm0i`"^?O5<S9KD$F@Z^?Ob@9klg,"j^

9#7+7"3N3HO"Tivoli Systems ^?O IBM ,DHrTCF$k9YFNqK*$F3Nh&J=J"Wm0i

`"^?O5<S9,xQD=G"k3Hr,:7b(9bNGO"j^;s#\qG3liN=J"Wm0i`"^?

O5<S9K@Z7F$kt,,"CFb"3N3HO Tivoli Systems ^?O IBM =J"Wm0i`"^?O5<S9

N_,HQD=G"k3HrU#9kbNGO"j^;s#3liN=J"Wm0i`"^?O5<S9Ke(F"Tivoli

Systems ^?O IBM N-zJN*j-"^?O=N>N!*K]n5l?"xK>$"!=*K1yN=J"Wm0i

`"^?O5<S9rHQ9k3H,G-^9#?@7"Tivoli Systems ^?O IBM KhCF@(*KXj5l?bNr

|-">RN=JHH_go;?lgN`nN>AH!ZO*RMNU$GTCF$?@-^9#

Tivoli Systems ^?O IBM O"\qGb@9kCv" (CvPjfNbNr^`) rj-7F$klg,"j^9#\q

Ns!O"*RMK3liNCv"KD$FB\"rvz9k3HrU#9kbNGO"j^;s#HQvzKD$F

O"<-N8hKqLKF4Hq/@5$#

)106-0032 l~TAh;\Z 3 z\ 2-31

IBM World Trade Asia Corporation

Intellectual Property Law & Licensing

J<N]ZO"q^?OOhN!'KhoJ$lgO",Q5l^;s#

IBM *hS=N>\^?OV\NRqRO"\qrCj*H7F=89k^^NuVGs!7"&J-N]Z"Cj\*

,g-N]Z*hS!'eNlS4]U$r^`9YFN@(b7/O[(N]ZU$rioJ$bNH7^9#q^?

OOhKhCFO"!'N/T,jKhj"]ZU$N)B,X8ilklg"/T,jN)Bru1kbNH7^9#

\qOj|*K+>5l",WJQ9 (?H(P";Q*KT,ZJ==dm"JI) O"\qN!GKH_~^l^9#

IBM O"o~"3N8qK-\5lF$k=J^?OWm0i`KP7F"~I^?OQ9rT&3H,"j^9#

\qK*$F IBM J0N Web 5$HK@Z7F$klg,"j^9,"X9N?a-\7?@1G"j"h7F=li

N Web 5$Hrd)9kbNGO"j^;s#=liN Web 5$HK"kqAO"3N IBM =JNqANltGO"

j^;s#=liN Web 5$HO"*RMNU$G4HQ/@5$#

\^Ke"kKX9k4U+d46[O"!N URL +i*wj/@5$##eN2MK5;F$?@-^9#

http://www.ibm.com/jp/manuals/main/mail.html

J*"|\ IBM /TN^Ke"kO$s?<MCHP3Gb4X~$?@1^9#\7/O

http://www.ibm.com/jp/manuals/ NV4m8KD$FWr4w/@5$#

(URL O"Q9KJklg,"j^9)

!6!5' GC32-0703-01

Tivoli®

Risk Manager User’s Guide

Version 3 Release 8

!/!T' |\"$&S<&(`t0qR

!4!v' J7gJk&is2<8&5]<H

h1~ 2001.11

3N8qGO"?.@+N™W3"?.@+N™W9"?.Q47C/N™W3"?.Q47C/N™W5"*hS?.Q47C/N™W7rHQ7F$^9#3N (qN*) O"(b) |\,J(qHHQ@sryk7HQ7F$kbNG9#U)sHH7F5G#=9k3HOX_5lF$^9#

�* ��™W3��™W9��™W3��™W5��™W7

© Copyright International Business Machines Corporation 2001. All rights reserved.

© Copyright IBM Japan 2001

iiiRisk Manager f<6<:&,$I

iv P<8gs 3 jj<9 8

��

= . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv

^(,- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii

\qNP]IT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii

0sroHJkqA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii

X"qA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii

Risk Manager qA. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xviii

\qN=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xviii

FON=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xviii

\qN=-,' . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix

*RM5]<HXNd$go; . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix

Risk Manager N Web ps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xx

>N=JKX9k Web ps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xx

h1O \jj<9N7!= . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

*Zl<F#s0&79F`N5]<HNWs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Web 5<P<N5]<HNWs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

G<?Y<9N5]<HNWs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

Tivoli Management Framework *hS Tivoli Enterprise Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

7,N Web Y<9Nps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

J1KJC?77$$s9H<k}! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

7,*hS!=/=5l?"@W?< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

*Zl<F#s0&79F` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

TEC ?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

z(HQU)<^s9N/= . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

I-easF<7gsNF=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

h2O Tivoli Risk Manager N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Risk Manager N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Risk Manager Nx@ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Risk Manager ,;-ejF#<X"Ndjrh}9k}! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

/~N?$W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Risk Manager Khk/~nTNh}}! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Risk Manager N3s]<MsH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

,\N Tivoli =J . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Risk Manager H Tivoli Enterprise Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

$YsH&G<?Y<9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

TEC $YsH&5<P< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

vRisk Manager f<6<:&,$I

TEC "@W?<. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

BAROC U!$k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

/i9jA9F<HasH&U!$k. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

U)<^CH&U!$k. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

h3O Tivoli Enterprise Console GNpsN=( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Risk Manager Web Intrusion Detection System (IDS) N7Jj* . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

TEC $YsH&0k<W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

$YsH&Se<"< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Risk Manager uV$YsH&0k<W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

7Jj*K5iK?/N$YsHrIC9k. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

TEC $YsH&Se<"< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Risk Manager Web Y<9psNHQ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

h4O Risk Manager N$s9H<k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

$s9H<kN5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

#tN$YsH&5<P<NWh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

$s9H<kgx. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Risk Manager N0K$s9H<k9k=J. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Risk Manager Event Integration Facility NWo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Risk Manager $s9H<kN3s]<MsH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

5<P<I}P]N<I&QC1<8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Risk Manager G-N$s9H<k&QC1<8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

$s9H<k*hS=.}!N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Tivoli G9/HCWKhk Risk Manager 3s]<MsHN$s9H<k . . . . . . . . . . . . . . . . . . . . . 39

Risk Manager D-QtXN"/;9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

G-N$s9H<kKhk Risk Manager 3s]<MsHN$s9H<k . . . . . . . . . . . . . . . . . . . . . 39

AIX 79F`K*1k"@W?<N$s9H<k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Linux 79F`K*1k"@W?<N$s9H<k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Solaris 79F`K*1k"@W?<N$s9H<k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Windows 79F`K*1k"@W?<N$s9H<k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

$YsH&5<P<N$s9H<k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

$YsH&5<P<N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Risk Manager H TME "@W?<NU)<^CH&U!$kNkg . . . . . . . . . . . . . . . . . . . . . 47

ACF rHQ7? Risk Manager "@W?<N=.*hS[[ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

ACF G=.,D=J"@W?<*hS;s5< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

ACF WmU!$krHQ7?"@W?<N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

$YsH&0k<W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

$YsH&0k<WNn. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Web Y<9psQN Risk Manager N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Web Y<9psQNG<?Y<9&Se<N_j. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

vi P<8gs 3 jj<9 8

Web Y<9psr=(9k?aN TEC _j . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

Risk Manager 3s]<MsHN|n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

I}P]N<I+iN|n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

G-N}!Khk"@W?<N"s$s9H<k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

h5O Risk Manager Server Correlation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

uV. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

Risk Manager Correlation 3s]<MsH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Risk Manager Correlation N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

=._jNQ9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Risk Manager =.9/jWH. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

Prolog U!$k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Risk Manager Server Correlation N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

k<k&Y<9Nh} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

Risk Manager Server Correlation 9/jWHNBT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

uV$YsHNbK?<. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

MCHo</&[9HNjA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

Hi9FCI&[9HNP? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

;s5<&$s9?s9NXj. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

;s5<&$s9?s9&$YsHNEgYN@&s0l<I . . . . . . . . . . . . . . . . . . . . . . . . . 67

;s5<&$s9?s9&$YsHN8.N^) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

$YsHNf<6<jA0-N_j . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

vF5lk?$`&9?sWQLN_j . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

uVN-z|B,ZlkPa~VN_j . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

-z|B,Zl?uVr/j<s"CW9k?aN~VVVN_j . . . . . . . . . . . . . . . . . . . . . . 70

jUlC7e&?$^<N~VVVN_j . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

lL*JbN+iqN*JbNXNuV$YsHN40 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

qN*JbN+ilL*JbNXNuV$YsHN40 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

:jMN_j . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

s;-e"&$YsHN|n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

uVG<?N>w. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

uVG<?r>w9k~|N_j . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

uVG<?NLN$YsH&5<P<XN>w . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

9H<`&$YsHN7-$MNjA. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

$YsHNjs/. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

E#$YsHN!P . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

77$+F4j<NXj. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

9<Q</i9&+F4j<NdjvF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

j<U&/i9N+F4j<XNdjvF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

CjN$YsH&/i9KD$FjXWm;9rHQTDK9k. . . . . . . . . . . . . . . . . . . . . . . . 81

(9+l<7gs7-$MN_j . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

$YsH&-cC7e&5$:N!:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

viiRisk Manager f<6<:&,$I

Risk Manager Server NQU)<^s9NQ9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

h6O Risk Manager Event Integration Facility. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

Risk Manager Event Integration Facility N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

Risk Manager Event Integration Facility H Tivoli Event Integration Facility HNfS. . . . . . . . . . 88

Risk Manager Observer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

Event Integration Facility &Qi$Vij< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

Perl 5]<H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

"@W?<&U!$k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

Risk Manager EIF 3^sI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

Risk Manager EIF N$s9H<k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

U)<^CH&U!$k*hS/i9jA9F<HasH&U!$kN=[ . . . . . . . . . . . . . . . 92

Perl 5]<HN$s9H<k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

TME ^?Os TME D-QN Risk Manager EIF N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

rmeif_cfg 3^sINc. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

Risk Manager EIF =.U!$k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

Risk Manager EIF =.U!$k&U)<^CH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

rmad.conf =.U!$kN-<o<I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

$YsH&U#k?< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

$YsH&PCU!<&U#k?<`n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

rmad_summary.rules U!$k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

Ws!=NcrHQ7?nH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

7,Wsk<kNn. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

A'C/&k<k&9/jWHNHQ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

=N>N Risk Manager EIF U!$k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

h7O Risk Manager TEC N?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

TEC ?9/NXj . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

UNIX 79F`N TEC ?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

Windows 79F`N TEC ?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

$YsHr"<+$V9k?aN TEC ?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

Risk Manager "@W?<r+O9k?aN TEC ?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

Risk Manager "@W?<rd_9k?aN TEC ?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

Check Point FireWall-1 QN TEC ?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

Cisco Secure PIX Firewall QN TEC ?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

Cisco Secure IDS QN TEC ?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

h8O Web Intrusion Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

Web Intrusion Detection System N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

5]<H5lk Web 5<P< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

Perl 5]<H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

viii P<8gs 3 jj<9 8

CLF "/;9&m0&U!$k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

sig.nefarious 70KAc<&U!$k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

Web IDS $YsHKP9k TEC jX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

Web IDS *hS Risk Manager Event Integration Facility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

m<k*<P<&5]<HN?aNm0&U!$k&"/;9NXj . . . . . . . . . . . . . . . . . . . 121

Web IDS N$s9H<k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

Web 5<P<KP9k Web IDS N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

Risk Manager EIF H;Q9k?aN Web IDS N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

TEC "@W?<H;Q9k?aN Web IDS N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Web 5<P<&"/;9&m0&U!$kN=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

Web IDS N$s9H<kNEv-!: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

I}?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

Web IDS =.U!$kNT8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

Web IDS N+O. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

Web 6b$YsHN,O . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

70KAc<&/i9NICH|n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

Web 6b70KAc<NICH|n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

Q?<s&F9HNkgH\Y= . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

T3J[9HNIC^?O|n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

T3J"/F#SF#<N?$WNXj . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

Hi9FCI&70KAc<NIC^?O|n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

7-$MH:jMN40 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

h9O Cisco Secure IDS Q"@W?< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

;s5<N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140

TEC Correlation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141

Cisco Secure IDS QN"@W?<N$s9H<kH=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141

Risk Manager EIF H&KHQ9k?aN Cisco Secure IDS QN"@W?<N=. . . . . . . . . . 141

Cisco Secure IDS DataFeed 3s]<MsHH&KHQ9k?aN Cisco Secure IDS Q"@W

?<N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

"I_K9Hl<?<N?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

Cisco Secure IDS "@W?<N+O . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

Cisco Secure IDS QN"@W?<Nd_ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

TEC ?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

Cisco Secure IDS "@W?<N+O . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

Cisco Secure IDS "@W?<Nd_ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

Cisco Secure IDS DataFeed N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

Cisco Secure IDS "@W?<NP9&(i<Nrh. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

Unix *hS Linux 79F`: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

Windows 79F`: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

ixRisk Manager f<6<:&,$I

h10O ISS RealSecure Q"@W?< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

;s5<N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

SNMP HiCW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

TEC Correlation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

ISS RealSecure Q"@W?<N$s9H<k*hS=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

ISS RealSecure Q"@W?<N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

]j7<Nn.*hS,Q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

$YsHQYNGg= . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

TEC SNMP "@W?<N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

UNIX QN Tivoli J0N SNMP "@W?<N;CH"CW . . . . . . . . . . . . . . . . . . . . . . . . . . 151

ISS RealSecure Q"@W?<NI} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152

SNMP "@W?<N+O . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152

SNMP "@W?<Nd_ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153

h11O Cisco k<?<Q"@W?< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

Cisco k<?<N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

TEC Correlation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156

Cisco k<?<Q"@W?<N$s9H<k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

$s9H<kNWh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

$s9H<k&9FCW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

Cisco k<?<Q"@W?<N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

TEC SNMP "@W?<N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

Cisco k<?<N;CH"CW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

UNIX QN Tivoli J0N SNMP "@W?<N;CH"CW . . . . . . . . . . . . . . . . . . . . . . . . . . 159

Cisco k<?<NI} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

SNMP "@W?<N+O . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

SNMP "@W?<Nd_ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

SNMP G<bsNd_ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

$YsH&5<P<NQ9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

UNIX 5<S9&U!$kNT8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

Cisco k<?<NHiCW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

Cisco k<?<G-NHiCW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

FoNHiCW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

lL*J SNMP 'Zc2HiCW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

h12O Cisco Secure PIX Firewall Q"@W?< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

Cisco Secure PIX Firewall N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

;s5<N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164

TEC Correlation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164

U!$"&)<kI}$YsH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

x P<8gs 3 jj<9 8

TEC k<k&(s8sKhk=G . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

Cisco Secure PIX Firewall Q"@W?<N$s9H<k*hS=. . . . . . . . . . . . . . . . . . . . . . . . . . 167

Cisco Secure PIX FirewallQ"@W?<r$s9H<k9k0K . . . . . . . . . . . . . . . . . . . . . . . . 167

Cisco Secure PIX Firewall Q"@W?<N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167

Cisco Secure PIX Firewall Q"@W?<N=.KD$FN+p. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168

Cisco Secure PIX Firewall N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168

TEC ?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

Cisco Secure PIX Firewall TEC ?9/rBT9k0K. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

Q9o<I*hS?9/psN]n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

;s5<&"/;9=.NQ9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

;s5<=.psN=( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

;s5<&m.s0=.NQ9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

Cisco Secure PIX Firewall NI} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

h13O Check Point FireWall-1 Q"@W?< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

Check Point FireWall-1 Q"@W?<N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

;s5<N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

Check Point FireWall-1 Q"@W?<N$s9H<k*hS=. . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

Check Point FireWall-1 N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

Risk Manager EIF GHQ9k?aN Check Point FireWall-1 Q"@W?<N=. . . . . . . . . . . 179

=.U!$k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

OPSEC 5<P<H7FN Check Point FireWall-1 N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181

OPSEC /i$"sHH7FN Check Point "@W?<N=. . . . . . . . . . . . . . . . . . . . . . . . . . 182

SAM 5<P<N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

OPSEC 5<P<XN Check Point "@W?<N\3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

"@W?<K*1k Check Point FireWall-1 "i<`Nh}]j7<N_j . . . . . . . . . . . . . . . . . . 184

Check Point FireWall-1 "@W?<NI} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

TEC ?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

TEC ?9/rT&0K . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

Windows NT GN+O . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

Solaris GN+O . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

Linux GN+O. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

IP "Il9psNWa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

=<9*hS8hKD$FNpsNWa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

Windows NT GN"@W?<Nd_ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

Solaris GN"@W?<Nd_ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

Linux GN"@W?<Nd_. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

I}`n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

Check Point FireWall-1 G<bsNO0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

Check Point FireWall-1 G<bsNd_ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

(i<h} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

xiRisk Manager f<6<:&,$I

Check Point FireWall-1 m0&aC;<8*hS0- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

/~X"Nm0&aC;<8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191

/~X"J0Nm0&aC;<8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191

U!$"&)<k0-N_j . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191

h14O Host Intrusion Detection Q"@W?< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

Host IDS Q Risk Manager "@W?<N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

TEC Correlation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

Host IDS Q"@W?<N$s9H<k*hS=.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

$s9H<kN`w . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

$s9H<k&9FCW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

Host IDS N=.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

TEC ?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196

h15O McAfee Alert Manager Q"@W?< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

McAfee Alert Manager Q"@W?<N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

;s5<N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

"@W?<N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

McAfee Alert Manager *hS McAfee NetShield "i<H&aC;<8 . . . . . . . . . . . . . . . . . 200

TEC Correlation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200

McAfee Alert Manager Q"@W?<N$s9H<k*hS=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

$s9H<kN`w . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

Windows 2000 K*1k McAfee Alert Manager N=.KX9kM8v`. . . . . . . . . . . . . . . . . 202

h16O Norton AntiVirus Q"@W?< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

Norton AntiVirus Q"@W?<N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

;s5<N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

"@W?<N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204

Norton AntiVirus $YsH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

TEC Correlation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

Norton AntiVirus Q Risk Manager "@W?<N$s9H<k*hS=.. . . . . . . . . . . . . . . . . . . . . 205

$s9H<kN`w . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

Tivoli (sI]$sHK*1k$s9H<k*hS=.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

s Tivoli N<IK*1k$s9H<k*hS=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

Windows 2000 K*1k Norton AntiVirus N=.KX9kM8v` . . . . . . . . . . . . . . . . . . . . . 206

h17O Network IDS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

Network IDS N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

Network IDSTEC Correlation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210

Network IDS "i<H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211

Network Intrusion Detection System N$s9H<k*hS=.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

Network Intrusion Detection Option N$s9H<k&QC1<8 . . . . . . . . . . . . . . . . . . . . . . . 212

xii P<8gs 3 jj<9 8

$s9H<kNWh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

Network IDS N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213

=.9FCW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213

Risk Manager TEC ?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213

Network IDS TEC ?9/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213

Network IDS NI} . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

nids 3^sIKhk Network IDS N+0O0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

+0O07J$lg . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

70KAc<&U!$kN97 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

Network IDS "i<H*hSpsNm.s0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

(?*Zl<7gsNF9H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

IP "Il9NJ, . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

[9H>Nh@ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

nids 3^sI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216

Network IDS 6b70KAc<. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

H_~_"i<H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

70KAc<&Y<9N"i<H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

h18O Tivoli Decision Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

Tivoli Decision Support for Enterprise Risk Management N5W . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

Tivoli Decision Support for Enterprise Risk Management qA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222

Tivoli Decison Support N$s9H<k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223

Tivoli Decision Support for Enterprise Risk Management N=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223

RISK Manager TEC G<?Y<9K*1k"<+$V&F<Vk"Se<"*hSHj,<Nn. 223

Tivoli Decision Support for Enterprise Risk Management NI}?9/ . . . . . . . . . . . . . . . . . . . . . . . 225

U?A. Risk Manager NaC;<8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

Risk Manager NjXaC;<8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

Network Intrusion Detection System NaC;<8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

$s9H<k&aC;<8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253

Check Point FireWall-1 NaC;<8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254

Check Point FireWall-1 ?9/NaC;<8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257

Cisco Secure IDS NaC;<8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259

Risk Manager 5<P<NaC;<8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263

Web Y<9NpsaC;<8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

Risk Manager Event Integration Facility NaC;<8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

Risk Manager EIF Observer NaC;<8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276

Web IDS NaC;<8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277

U?B. ^$0l<7gs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285

"@W?< P<8gs 3.8 JeNF$s9H<k^?O"CW0l<I. . . . . . . . . . . . . . . . . . . . . 285

xiiiRisk Manager f<6<:&,$I

Risk Manager P<8gs 3.7 rHQ7F$s9H<k5l?"@W?<+iN^$0l<7gs 286

Risk Manager Server N^$0l<7gs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288

U?C. Cisco Secure IDS 6b70KAc< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289

U?D. ISS RealSecure 6b70KAc< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297

MCHo</6b70KAc< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297

79F`6b70KAc< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299

U?E. McAfee Alert Manager *hS McAfee NetShield "i<H&aC;<8 301

U?F. Network IDS 6b70KAc< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307

Network IDS H_~_"i<H. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307

'Z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308

PC/&I" . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308

=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308

5<S982 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308

LOKI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308

e! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309

9Fk9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309

70KAc<&Y<9N"i<H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309

FQ"i<H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309

'Z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315

PC/&I" . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317

=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317

5<S982 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319

Gopher . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320

LOKI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320

Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320

e! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320

Ql8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325

wz . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333

xiv P<8gs 3 jj<9 8

�

1. Risk Manager *Zl<F#s0&79F`N5]<H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

2. Risk Manager Web IDS ,5]<H9k Web 5<P< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

3. Risk ManagerU)<^CH&U!$k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

4. $s9H<k*hS=.}!N5W. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

5. AIX G$s9H<kD=J Risk Manager QC1<8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

6. Linux G$s9H<kD=J Risk Manager QC1<8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

7. Solaris G$s9H<kD=J Risk Manager QC1<8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

8. Windows 79F`QN Risk Manager QC1<8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

9. Risk Manager "@W?<r"s$s9H<k9k?aNG-N3^sI . . . . . . . . . . . . . . . . . . . . . . 55

10. Risk Manager Server Correlation KhjjA5lkuV . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

11. ~VVVrCKQ9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

12. Risk Manager KhjjA5lk+F4j< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

13. 7-$MH</sNjA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

14. uVN?$W*hS5k5lkz-t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

15. ;s5<KhCFu.5lk*j8JkN$YsH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

16. Ws!=Khjh}5l?$YsH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

17. Web IDS ,5]<H9k Web 5<P< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

18. Check Point FireWall-1 Khj5]<H5lkHiC/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

19. "i<HN+F4j< . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307

xvRisk Manager f<6<:&,$I

xvi P<8gs 3 jj<9 8

��

\qGO"Tivoli® Risk Manager (\qGO Risk Manager HFS^9) N$s9H<k"=

."*hSI}N}!KD$Fb@7^9#^?"Risk Manager NF3s]<MsHN5W

rb@7^9#

��\qO"Tivoli Management Framework *hS Tivoli Enterprise Console KX9k=wN1r

}CF$kMrP]H7F$^9#ITO"!N3HrB]KP37F$k,W,"j^9#

¶ 5<I&Q<F#<N/~!N"Wj1<7gsN$s9H<k*hSHQ#

¶ =JN$s9H<k#Risk Manager O Tivoli G9/HCWrHQ7F"=J$a<8r

$s9H<k7^9#

¶ Tivoli "@W?<=.!= (ACF) *hS"@W?<=.WmU!$k (ACP) NHQ#

Risk Manager O"MCHo</N;-ejF#<&]j7<"CK/~!N79F` (IDS)

N$sWjasH4vT~1N=JG9#ITO"MCHo</&;-ejF#<NBQ*J

N1,"j"Aw)fWmH3k / $s?<MCH&WmH3k (TCP/IP)"MCHo<-s

0NpC50"*hSP)Xj5l?MCHo</KD$F=,K}r7F$k,W,"j^

9#

��ITO"Tivoli Enterprise Console (TEC) rHQ9kK"?CF"J<N^Ke"kr}r7

F$k,W,"j^9#

¶ Tivoli Framework Planning and Installation Guide" Tivoli Framework f<6<:&,$

I"*hS Tivoli Framework jU!ls9&^Ke"k

3liNqAGO"G9/HCW"I}P]N<I""I_K9Hl<?<"]j7<&

j<8gs"WmU!$k"mUv`"?9/"918e<js0"*hS3^sIT$

s?<U'<9 (CLI) 3^sIKD$F\7/b@7F$^9#

¶ Tivoli Enterprise Console f<6<:&,$I

3NqAO"Enterprise Console NHQKD$F\7/-\7^9#

��J<NqAO"0sroHJkqAK-\5lF$kpsrd-9kbNG9#

¶ Tivoli Enterprise Console k<k&Sk@<Q,$I

3NqAO"7,k<krn.7F}g9k}!KD$F\7/-\7^9#

¶ Tivoli Event Integration Facility User’s Guide

3NqAGO"Event Integration Facility (EIF) rHQ7F"H+N$YsH&"@W?<

r+/9k}!rb@7^9#3liN$YsH&"@W?<O"ITNMCHo</D

-*hSITNCjN,W-K~8Fj,C(il^9#

¶ Tivoli Enterprise Console Reference Manual

3NqAO"3^sIT$s?<U'<9KD$F\7/-\7^9#

xviiRisk Manager f<6<:&,$I

¶ Tivoli Enterprise Console "@W?<&,$I

3NqAO"=_~jG-k Tivoli Enterprise Console "@W?<KD$F\7/b@7

^9#

Risk Manager ��Risk Manager NqAKO"!NbN,"j^9#

¶ VTivoli Risk Manager jj<9&N<HWGO"Risk Manager KX9kpsr8q=7

F$^9#3NU!$kO"J<N=J CD Nk<H&G#l/Hj<K"j^9#

¥RM38relnotes.pdf

¶ \qG"kVTivoli Risk Manager f<6<:&,$I P<8gs 3.8WO" PostScript

Document Format A0NU!$k (.pdf) H7F=J CD Gs!5l^9#3NU!$k

O"!NG#l/Hj<K"j^9#

¥books¥rm38user.pdf

¶ VTivoli Risk Manager GYmCQ<:&,$I P<8gs 3.8WKO" Risk Manager

Event Integration Facility N5W"API *hS3^sIT$s?<U'<9ps"*hSH

+N Risk Manager _9"@W?<Nn.}!KX9kps,^^lF$^9#3NU!

$kO"!NG#l/Hj<K"j^9#

¥books¥rm38devgd.pdf

¶ Tivoli Decision Support for Enterprise Risk Management Njj<9&N<HO"J<NG

#l/Hj<K"j^9#

¥books¥tdserm11.pdf

��=J*hS\qNQ9bFKD$FO"VTivoli Risk Manager jj<9&N<HWr2H7

F/@5$#

��

¶ 1Z<8NX\jj<9N7!=YGO"\jj<9GNQ9bFrj9H7^9#^?"

,WJpsr+U1d9/9k?aNm<I^CWbs!7^9#

¶ 7Z<8NXTivoli Risk Manager N5WYGO"Risk Manager N5Wr(7^9#

¶ 33Z<8NXRisk Manager N$s9H<kYGO"Risk Manager 3s]<MsHN$s

9H<k}!KD$Fb@7^9#

¶ 57Z<8NXRisk Manager Server CorrelationYGO"jXKX9kQl"Wm;9"*h

SI}?9/r^`"Risk Manager TEC Correlation rRp7^9#

¶ 87Z<8NXRisk Manager Event Integration FacilityYGO"Risk Manager Event

Integration Facility KD$Fb@7^9#3lO"Risk Manager _9NH+N"@W?<

rn.9k?aK Risk Manager ,s!9kD<k-CHG9#

¶ 107Z<8NXRisk Manager TEC N?9/YGO"Risk Manager ,s!9k TEC ?9

/rRp7^9#

¶ 113Z<8NXWeb Intrusion DetectionYGO"Risk Manager s!N;s5<G"k Web

Intrusion Detection System (Web IDS) KD$Fb@7^9#

xviii P<8gs 3 jj<9 8

¶ 139Z<8NXCisco Secure IDS Q"@W?<YGO"Cisco Secure IDS (J0O

NetRanger) QN"@W?<rRp7^9#

¶ 147Z<8NXISS RealSecure Q"@W?<YGO"ISS RealSecure QN"@W?<KD$

Fb@7^9#

¶ 155Z<8NXCisco k<?<Q"@W?<YGO"Cisco k<?<QN"@W?<KD$

Fb@7^9#

¶ 163Z<8NXCisco Secure PIX Firewall Q"@W?<YGO"Cisco Secure PIX Firewall

QN"@W?<rRp7^9#

¶ 177Z<8NXCheck Point FireWall-1 Q"@W?<YGO"Check Point FireWall-1 QN

"@W?<rRp7^9#

¶ 193Z<8NXHost Intrusion Detection Q"@W?<YGO"Host Intrusion Detection

System (IDS) QN"@W?<KD$Fb@7^9#

¶ 197Z<8NXMcAfee Alert Manager Q"@W?<YGO"McAfee Alert Manager QN"

@W?<KD$Fb@7^9#

¶ 203Z<8NXNorton AntiVirus Q"@W?<YGO"Norton AntiVirus QN"@W?<K

D$Fb@7^9#

¶ 209Z<8NXNetwork IDSYGO"Network Intrusion Detection (Network IDS) *W7gs

KD$Fb@7^9#

¶ 221Z<8NXTivoli Decision SupportYGO"Tivoli Decision Support for Enterprise Risk

Management rWs7^9#

\qO"/~!NH;-ejF#<X"QlNQl8Hwzr^_^9#

��\qGO"Windows® 79F` O"Windows NT™ ^?O Windows 2000™ *Zl<F#s

0&79F`rHQ9k3sTe<?<&79F`rU#7^9#UNIX 79F` O"

AIX™"Linux™"^?O Solaris™ JIN UNIX™ *Zl<F#s0&79F`rHQ9k3

sTe<?<&79F`rU#7^9#

\qGO"CLJQld"/7gsKD$F$/D+NqNN,'rHQ7^9#3liN,

'KO!NU#,"j^9#

,' U#

@z 3^sI"-<o<I"Ui0JINpsO@zG(7^9#

$?jC/f<6<,~O9k,WN"kQt"*hS7,NQlO$?jC/ G(7^

9#/4lgb"$?jC/ G(7^9#

�� 3<G#s0c"PO"*hSU!$k>O��G(7^9#

�� qA*hS+9?^<&5]<HKD$FODH4vTK*?:M/@5$#

xixRisk Manager f<6<:&,$I

Risk Manager � Web ��Tivoli *hS IBM Tivoli N+9?^<O"Tivoli ;-ejF#<=J*hS Risk Manager

KX9k*si$spsrxQ9k3H,G-^9#

Risk Manager KX9k=JNG7N97bF"*hS5<S9psKD$FO"Web 5$H

(http://www.tivoli.com/support/secure_download_bridge.html) r2H7F/@5$#

Tivoli Risk Manager =JKD$FO"!N Web 5$Hr2H7F/@5$#

http://www.tivoli.com/products/index/risk_mgr/

>N Tivoli ;-ejF#<I}=JKD$FO"!N Web 5$Hr2H7F/@5$#

http://www.tivoli.com/products/solutions/security/

�� Web ��\qG2H7F$k>N=J*hS5<S9KX9k*si$spsO"\qNPG~@K*

1kG7psG9#

xx P<8gs 3 jj<9 8

��

3N;/7gsGO"Risk Manager 3.8 KC(il?"0Njj<9+iNQ9@KD$Fb

@7^9#

� ��=1 K"\jj<9K*$F Risk Manager 3s]<MsH,5]<H9k*Zl<F#s

0&79F`rj9H7^9#

= 1. Risk Manager *Zl<F#s0&79F`N5]<H

AIX 4.3.3 Solaris2.7

Solaris 2.8 Linux Windows NT4.0

Windows 2000

Risk

Manager

5<P<

X X X X

Tivoli

Decision

Support

X

Check Point

FireWall-1

X X X RedHat

6.2/7.0

X

Cisco Secure

IDS

"@W?<

X X Linux

Kernel

2.2.16

X X

Norton

AntiVirus

X X

McAfee Alert

Manager

X X

Host IDS X X X RedHat

6.2/7.0

X X

Network IDS X X X RedHat

6.2/7.0

Web IDS X X X RedHat

6.2/7.0

X X

Cisco Secure

PIX Firewall

"@W?<

X X X X

Cisco

k<?<

X X X X

ISS

RealSecure

X X X X

1

1Risk Manager f<6<:&,$I

1.�

��

��

�

= 1. Risk Manager *Zl<F#s0&79F`N5]<H (3-)

AIX 4.3.3 Solaris2.7

Solaris 2.8 Linux Windows NT4.0

Windows 2000

ISS

RealSecure

*hS Cisco

k<?<r

5]<H9

k TEC

SNMP "@

W?<

X X X X

Risk

Manager

Event

Integration

Facility

X X X RedHat

6.2/7.0

X X

Web ��=2 K"Risk Manager Web IDS ,5]<H9k Web 5<P<rj9H7^9#

= 2. Risk Manager Web IDS ,5]<H9k Web 5<P<

Web 5<P< AIX 4.3.3 Solaris 2.7 Solaris 2.8 Windows NT 4.0

Apache 1.3.17 X X

Apache 1.3.9 X X

Domino 5.0.6 X X

I-Planet 4.1 X X X X

Microsoft ISS 4.0 X

IBM HTTPD

1.3.12.2

X X

WebSeal 3.7 X X

��Risk Manager 3.8 O"J<NG<?Y<9r5]<H7F$^9#

¶ Oracle Database P<8gs 8.1.x

¶ IBM DB2 P<8gs 6.1 *hS 7.1

¶ Sybase Adaptive Server Enterprise (ASE) P<8gs 11.5"11.9x"*hS 12.0

Tivoli Management Framework �� Tivoli Enterprise ConsoleRisk Manager 3.8 N3s]<MsHO"J<G'Z5lF$^9#

¶ Tivoli Management Framework V3.7"V3.7.1

¶ Tivoli Enterprise Console V3.7.1

2 P<8gs 3 jj<9 8

�� Web ��Risk Manager 3.8 KO"Risk Manager uV$YsHKD$FN Web Y<9Nps,^^l

F$^9# Risk Manager uVKX"7?D9N Risk Manager $YsHKX9kICpsr

=(9k3H,G-^9#3NpsO"Tivoli Enterprise Console (TEC) G~j9k3H,G

-^9#

��Risk Manager 3s]<MsHH"@W?<O"5<P<KG-NJ<N$s9H<k&Wm

0i`rHQ7F$s9H<k9k3H,G-^9#

¶ installp (AIX Nlg)

¶ pkgadd (Solaris Nlg)

¶ rpm (Linux Nlg)

¶ InstallShield (Windows 79F`Nlg)

U!$krr`7"j0G$s9H<k9k,WO"j^;s# Software Installation Services

(SIS) Khk$s9H<k}!O5]<H5lJ/Jj^7?#

��

McAfee Alert Manager "@W?<

Risk Manager KO"McAfee Alert Manager P<8gs 4.5 QN"@W?<,"j^

9#3N"@W?<KD$F\7/O"197Z<8NXMcAfee Alert Manager Q"@

W?<Yr2H7F/@5$#X"9k McAfee Alert Manager N$YsHO"TEC

Windows Event Log "@W?<+ihj~^l^9#

Internet Security Systems RealSecure (ISS RealSecure) "@W?<

ISS RealSecure 6.0 O"ISS RealSecure 6.0 Network Engine *hS System Agent K

hCFn.5lk"7,^?OQ95l? Simple Network Management Protocol

(SNMP) HiCWr5]<H7F$^9#

Check Point FireWall-1Check Point FireWall-1 O"Operations Security (OPSEC) i$Vij<r977^7

?#Linux WiCHU)<`,5]<H5lF$^9#

Cisco Secure IDS "@W?<

Cisco Secure IDS "@W?<O"Software Development Kit (SDK) rHQ7F>hN

Netranger "@W?<r"CWG<H7?$sWjasF<7gsG9#3N$sWj

asF<7gsO"Fo Cisco IDS =Jr5]<H7F$^9#

Host IDSWindows 2000 WiCHU)<`O"$YsH&m0+iN Active Directory N$Y

sHr^a"Risk Manager Host IDS G5]<H5lF$^9#

Host Intrusion Detection System (Host IDS) O"RedHat Linux 6.2 *hS 7.0 G5]

<H5lF$^9#

Web IDSWeb IDS O"RedHat Linux *hS Windows 2000 eG5]<H5lF$^9#


1.�

��

��

�

[HsIN Web 5<P<O"$UN~V,Pa9kHLNm0&U!$kKZjX

(kh&K918e<k9k3H,G-^9 (?H(P 1 |K 1 s)# Web IDS

O"*;;:K7,Nm0&U!$kKZjX(k3HbG-km<k*<P<&m

0&5]<Hr5]<H7F$^9#

Norton AntiVirusP<8gs 7.0 *hS 7.5 ,5]<H5lF$^9#

� ��Web IDS"Risk Manager Event Integration Facility"Risk Manager Perl"Host IDS"*hS

Network IDS G"Linux ,5]<H5lkh&KJj^7?#

TEC ��J<N TEC ?9/,IC5l^7?#

;s5<&$YsHN"<+$V

Tivoli Decision Support (TDS) rHQ7F"G<?&^$Ks0QK Risk Manager

;s5<&$YsHr"<+$V9k3H,G-^9#

$YsHN"<+$VN918e<k

G<?&^$Ks0N?aK"Risk Manager ;s5<N$YsH&G<?rj|*K

"<+$V9kh&918e<k9k3H,G-^9#

=N>N TEC ?9/O"CjN*Zl<F#s0&79F`&WiCHU)<`4HK!=

/=,^ilF$^9#

�� !��z(HQU)<^s9KP7FO"J<N/=,^ilF$^9#

¶ Risk Manager Event Integration Facility Observer GO"h}Nz(r5iKe2"MCH

o</&HiU#C/r/J/7"jXrb.KT&?aK"$YsHNm<+kh}r

Xj9k3H,G-^9#\jj<9GOJ<Nh&KJj^7?#

v Risk Manager "@W?<+i TEC Kwilk$YsHNt,:/7^7?#Ws$

YsHrHQ7F"fS*?tNE#^?O`wN$YsHr=93H,G-^9#

v $YsHO"J39Hl<8K]I5l^9#7?,CF"G<?O"TEC 5<P<

r=NlGHQG-J/Fb":ol^;s#

v Tivoli Management Enterprise (TME) N(sI]$sH*hS TME J0N(sI]$

sHN>},5]<H5lF$^9#

¶ G-N$s9H<k}!Khj"$s9H<kNz(,~e5l^7?#

¶ R9Hj<&l]<H,5iKz(=5l"TDS "<+$V&G<?Y<9KsoK?t

ND9N$YsHrhj~`3H,G-kh&KJj"l}G 1 ! TEC 5<P<K?(

kFAr.5/7F$^9#

¶ Tivoli Management Framework 3.7.1 !=rHQ7F"U!$"&)<krLk]<Hr/

J/7F SSL rHQ7";-ejF#<r~I7F$^9#

4 P<8gs 3 jj<9 8

�"#$��%��

Network Intrusion Detection (Network IDS) *W7gs\qGO Network IDS ;s5<KD$F8q=7F$^9#J0O"1;s5<N

m8H8q=OL9KTolF$^7?#

(i<&aC;<8

\qKO"Risk Manager 3s]<MsHKP9k(i<&aC;<8Nb@,^^l

F$^9# Risk Manager aC;<8KD$FO"227Z<8NXRisk Manager Na

C;<8Yr2H7F/@5$#

\qNI-easF<7gsNgt,,F=.5l^7?#ONgVrBSX("$s9H<

kpsO 1 DN$s9H<kNOK<akh&K7^7?#


1.�

��

��

�

6 P<8gs 3 jj<9 8

Tivoli Risk Manager ��

%@"OC+<"Ku ] 3liO9YF e-business KP9kG7N5$P<6bG"j";

-ejF#<KP7F^kAYs@<Khk}g*J"Wm<Ar+/9k,W-r/49k

bNG9#77$A0N5$P<6bNP=Khj"e-business GO"3liN6b+i88

kS8M9&j9/Kj^Ph7J1lPJj^;s#

Tivoli Systems Inc. (Tivoli) O"e-business ,3liN5$P<6br'17FI_9k3Hr

D=K9k;-ejF#<I}*hS"/;9)f=je<7gsrs!9k@G"h3*J

rdrL?7F$^9# Tivoli Nl"N;-ejF#<=JO"e-business K;-ejF#

<&Ul<ò</rs!7^9#3NUl<ò</O"H%,H+N IT pWr]n9k

?aNo,KG@rvF?+/rT&NKr)A^9#

Tivoli O"*<WsG91<iSjF#<Nb$"#tNWiCHU)<`K&LNF/Nm

8<I}=je<7gsrs!7F*j"3liOMCHo</"79F`""Wj1<7g

s"*hSkHV (B2B) N e-commerce KZS^9#$&Nh,K)DkHO"Tivoli =U

H&'"*hS Tivoli Ready =JrHQ7F"MCHo</"79F`"G<?Y<9"*

hS"Wj1<7gsNI}N39HH#(5ro:9kNKr)FF$^9#Tivoli Ready

=JN}gQ<HJ<O"Tivoli I}=UH&'"H}g9kh&'Z5l?"*RM,~j

G-kO<I&'"*hS=UH&'"=JNOOrH%7F$^9#

Risk Manager ��kHr]n9kKO"H+N e-business N$sUi9Hi/Ac<KP9kCjN;-ejF

#<Wor~?9;-ejF#<=Jrw(F*+J1lPJj^;s#^?"kHKO"#

tN;-ejF#<&3s]<MsHr 1 DN3s=<kKH_~`?aK"I}3s]<

MsH@1GJ/G1NB)*hS]j7<r$sWjasH9kNrgu9k;-ejF#

<&5<S9s!Tb,WG9#

Risk Manager O"Gh<;QrHQ7?/~!NQNI}79F`G9#Risk Manager O"

5^6^Jb"*hS5<I&Q<F#<N;s5<&"Wj1<7gs+i/~!N"i<

Hru.9k!=rw(F$^9#/~!N79FÒ"5<S9826b"k$O"9-c

s6bdUiCG#s06br\*H7?/~rj"k?$`G!P*hSbK?<7^9#

Risk Manager O"/~!N"i<HN+0h}Khj"\vN"i<HHVcC?"i<H

rhL9kNru1^9#3N+0h}O4/lL*JbNG"j";s5<+NKOX8J

/"#tN/~!N79F`+iN"i<Hrh}9k3H,G-^9#

Risk Manager ��Risk Manager O"J<N@+i"e-business N]nKr)A^9#

¶ 6b"<w"*hSx+NbK?<rl5I}7^9#/~!N79FÒ?tN"i<

Hr8.7^9#"i<HO"j_K)\KX"7F$?j",\*KO18djKhC

2


2.T

ivoli

Risk

Man

ager�

��

Fz-/35l?j"^?O/~!N79F`+NKhCFz-/35l?j9k3H,

"j^9#1lN/~!N$YsH&3s=<kG"k Tivoli Enterprise Console O";

-ejF#<jX$YsHr}g7FI}7^9#

¶ /~!N79F`Nf<6<,",~-N"k;-ejF#<jJG~z7d9/7^

9#

¶ "Wj1<7gs"5<S9"G<?Y<9"MCHo</&GP$9"*hS*Zl<

F#s0&79F`Ne@KPh7^9#

¶ spJ7[o (false positive) JINT,WJpsro:9kl}G"B]N;-ejF#

<<Rr1L7^9#

¶ ;-ejF#<NlgHGJ$f<6<,";-ejF#<eNj9/rj"k?$`G

bK?<7F>AG-kh&K7^9#

Risk Manager �&"#��Risk Manager O"/~d;-ejF#<X"Ndj,/87?lgK""I_K9Hl<?

<,"i+8aWh5l?~zrFSP93H,G-kh&"MCHo</&^M<8c<^

?O"I_K9Hl<?<K"i<HrP7^9#GiK""I_K9Hl<?<O"JK+

,/87?3HrNk,W,"j^9#!K"JK,/87?N+"I3G/87?N+"=

7FJ</87?N+rNk,W,"j^9#GeK""I_K9Hl<?<O""i+8a

Wh5l?~zrFSP93H,G-^9#

Risk Manager O"F/~nTKX9kJ<NpsrM8K~l^9#

=<9 /~nT,/87?lj#3NpsO"[9H>^?O IP "Il9G"k3H,"

j^9#

?<2CH

/87?/~nTNP]#?<2CHO"[9H"Web 5<P<"Q9o<I&U!

$k"^?O=N>N"ifk79F`&j=<9G9#^?"PC/lYk&Wm

0i`^?O&#k9N$s9?s9NHQrnT7F$klgb"j^9#

/~st

=<9+i/~nT,Tol?st"*hSFAru1??<2CHNt#

+F4j<

/~nTN?$W#/~nTKO"5<S9826b"Web 6bJI,"j^9#

EgY Risk Manager N=.~K"/~nTNEgYrhj7^9#

��MCHo</G/89k/~KOto`NbN,"j^9#Risk Manager O"3li9YF

No`N6b+iN]nrs!7^9#

/~KO"v3K/87?bNb"lP"5EKBT5l?;-ejF#<6bNlgb"j

^9# 9Z<8N^1 O"1 DN=<9+i 1 DN?<2CHKP7FTol?/~nTr

(7?bNG9#=N=<9+i=N?<2CHKO"/~,#tsTolF$kD=-,"

j^9#

8 P<8gs 3 jj<9 8

#tN=<9+i 1 DN?<2CHXN/~nT,/89k3Hb"j^9#"k0k<W

,CjN5<P<r5]9k[INlF6brE]1?H[|7F/@5$# ^2 O"#t

N=<9+i 1 DN?<2CHXN/~nTr(7?bNG9# ^2 K(7F$kNOtD

N/~nTG9,"B]N/~nTO?iKbek3H,"j^9#

b& 1 DNcH7F"1 DN=<9,#tN?<2CHN;-ejF#<N/2rnT9k

lg,"j^9# 1 DN0k<W"k$ODM,"MCHo</bN#tN?<2CHKO

}*K"/;9rn_klg,"j^9# ^3 O"1 DN=<9+i#tN?<2CHXN

/~nTr(7?bNG9# ^3 K(7F$kNOtDN/~nTG9,"B]N/~nT

O?iKbek3H,"j^9#

GeK"#tN=<9+i#tN?<2CHK~1FN6b,M(il^9# 10Z<8N^4

O"#tN=<9+i#tN?<2CHXN/~nTr(7?bNG9#10Z<8N^4 K(

7F$kNOo:+tDN/~nTK9.^;s,"B]N/~nTO?iKbek3H,"

j^9#

^ 1. 1 DN=<9+i 1 DN?<2CHXN/~nT

^ 2. #tN=<9+i 1 DN?<2CHXN/~nT

^ 3. 1 DN=<9+i#tN?<2CHXN/~nT


2.T

ivoli

Risk

Man

ager�

��

Risk Manager ��3N;/7gsNcGO"Risk Manager ,/~nTrINh&Kh}9k+r(7^9#3

Nc"*hS^5 GO"999 N/~nT,/87F$^9#9YFN/~nTO18=<9+

iNbNG"j"18?<2CH,=NFAru1F$^9#gLbNtzO"J<r(7F

$^9#

1 /~nTN=<9

2 /~nTN?<2CH

3 /~nTN+F4j<#3lO"/~nTNo`G9#

EgYO""I_K9Hl<?<,Xj7^9#"I_K9Hl<?<O"3N$YsH&?

$WNtz,g-/JkH"/~nTNEgY,}93HbXj7F$^9#3N=<9+i

N 1 DN$YsHO=l[IEgJbNGO"j^;s#7+7"18=<9+i18?<

2CHX 999 bN/~nT,/89kH"vOEgKJj^9#

��

XRisk Manager Khk/~nTNh}}!YO"999 N/~nTr(7F$^9#Risk

Manager NjX5<P<O""I_K9Hl<?<,h}G-kh&K9k?aK"999 N/

^ 4. #tN=<9+i#tN?<2CHXN/~nT

^ 5. /~nT

10 P<8gs 3 jj<9 8

~nTr TEC Kw.9k3H,G-^9,"3lOz(*GO"j^;s#"I_K9Hl

<?<O"?iH$&U#NJ$$YsHK5]5lF"EgJ/~nTr+:CF7^&3

H,"j^9#

jXO"$YsHNF3s]<MsHG"k 1"2"3"*hS=NEgYrfS7^9#

=NeojK"Risk Manager O"$YsHrfS7F"`wN$YsHr8s9k3H,G

-^9#3NcGO"999 N$YsHO9YF`wNbNG9# Risk Manager O$YsH

r"999 N`wN$YsHr^` 1 DNuVK8s7^9#

8s9k$YsH"/~$YsHN?$WKdjvFkEgY"*hS$YsH,B]K/8

7?H-K"I_K9Hl<?<,HkWh"/7gsrXj9k3H,G-^9#

Risk Manager �'��(�Risk Manager KO"J<N3s]<MsH,^^lF$^9#

1lN/~!N*hSI}3s=<k

Risk Manager O79F`I}H/~!NN>}r\*H7F"1lN8fI}3s=

<kG"k Tivoli Enterprise Console (TEC) +i e-business N;-ejF#<eNj

9/rI}7^9#3N3s=<k,s!9k/~!N$YsHN=(O"I}Ul

<`o</KhCFh}5lk>N$YsHN=(K`w7F$kNG"I},hj

z(*KJj^9#

5<P<&N$YsHjX

Risk Manager O"#tN;s5<+i~OG<?r}87"F;s5<+iNPO*

hS"i<HrX"U1F"B]K6b,"k+I&+r=G7^9#!K Risk

Manager ,3Npsr"8fI}3s=<kN Tivoli "I_K9Hl<?<Kwj^

9#

Event Integration Facility (EIF) D<k-CH

Risk Manager O"H+N$YsH}g!=D<k-CHG"k Risk Manager Event

Integration Facility (EIF) rH_~sG$^9#"Wj1<7gs&Wm0i_s0&

$s?<U'<9rHQ9kH"H+N Risk Manager _9"@W?<r+/9k3

H,G-^9#

Risk Manager "@W?<^?O;s5<""k$O=Na/N79F`K Risk

Manager EIF r[V9kH"h}Nz(=JiSKHiU#C/No:rT&3H,

G-^9#

/~!N;s5<

Risk Manager KO"J<K(7?/~!N;s5<N;CH,^^lF$^9#

Web Y<9N/~!N;s5<

Risk Manager KO"Web 5<P<KP9k6b*hS?o7$"/F#SF

#<r!P9k Web Intrusion Detection System (Web IDS) ;s5<,H_~

^lF$^9#

[9H&Y<9N/~!N;s5<

;-e"J*Zl<F#s0&79F`K Host Intrusion Detection System

(Host IDS) QN Risk Manager "@W?<r[V7F";-ejF#<dj

^?O/2r!P9k3H,G-^9#


2.T

ivoli

Risk

Man

ager�

��

MCHo</&Y<9N/~!N;s5<

Risk Manager MCHo<//~!N79F` (Network IDS) ;s5<O"M

CHo</&Y<9N6b*hS?o7$"/F#SF#<r!P7^9#

/~!N"@W?<

Risk Manager O";s5<4HK"@W?<rs!9k3HKhj"TNN;s5<

KhCF8.5l?$YsHrhj~_^9#

Risk Manager O"TNN5<I&Q<F#<N;s5<+iG<?rhj~`?a

K"J<N"@W?<rs!7F$^9#

¶ ISS RealSecure QN"@W?<#3N"@W?<O"ISS RealSecure NTNP<8

gsKhCF8.5l?"i<`r TEC $YsHK^CW7^9#

¶ Cisco Secure IDS Q"@W?<#3N"@W?<O"Cisco Secure /~!N79

F` (J0N>NO NetRanger) NTNP<8gsKhCF8.5l?"i<`r

TEC $YsHK^CW7^9#

¶ Cisco Routers Q"@W?<#3N"@W?<O"Cisco k<?<KhCF8.5

l?*rQ_N"i<`r"TEC SNMP "@W?<rHQ7F TEC $YsHK

^CW7^9#

¶ Cisco Secure PIX Firewall Q"@W?<#3N"@W?<O"Cisco Secure PIX

Firewall KhCF8.5l?"i<Hr TEC $YsHK^CW7^9#

¶ Check Point FireWall-1 Q"@W?<#3N"@W?<O"Check Point™

Firewall-1® =JKhCF8.5l?"i<Hr TEC $YsHK^CW7^9#

¶ McAfee Alert Manager Q"@W?<#3N"@W?<O"McAfee Alert Manager

=JKhCF8.5l?"i<Hr TEC $YsHK^CW7^9#

¶ Norton AntiVirus Q"@W?<#3N"@W?<O"Norton AntiVirus =JKhC

F8.5l?"i<Hr TEC $YsHK^CW7^9#

¶ Host IDS Q"@W?<#3N"@W?<O"*Zl<F#s0&79F`KhC

F!P5l"m0K-?5l?$YsHr TEC $YsHK^CW7^9#

Tivoli Decision Support for Enterprise Risk ManagementTivoli Decision Support (TDS) for Enterprise Risk Management O"Tivoli Risk

Manager =Jrd/9kbNG9#TDS O"U!$"&)<k""sA&#k9&"

Wj1<7gs"*hS/~!N79F`JINMCHo</&;-ejF#<&7

9F`NQU)<^s9KX9kHqr+/9k}!r-R7F$^9#

13Z<8N^6 O"Risk Manager N3s]<MsHVNblYkNX8rA$?bNG9#

12 P<8gs 3 jj<9 8

�� Tivoli ��Risk Manager O"Tivoli Management Enterprise Framework bG0n7^9#Risk Manager r

HQ9kKO"$/D+N Tivoli =J,,WG9# Risk Manager H&KHQ9k?aK,

\N Tivoli =JKO"J<NbN,"j^9#

¶ Tivoli Management Enterprise Framework (J0N TME/10 Management Enterprise

Framework)"P<8gs 3.7.1

¶ Tivoli Enterprise Console"P<8gs 3.7.1

¶ Tivoli Management Agent"P<8gs 3.7 ^?OP<8gs 3.7.1

¶ Tivoli Adapter Configuration Facility (ACF) P<8gs 3.7.1 (*W7gs)

¶ Tivoli Decision Support P<8gs 2.1.1 (*W7gs)

Risk Manager O"0sroHJk Tivoli =Jr"=JNltH7FOs!7F$^;s#

$s9H<kNjgKD$FO"F=JN Tivoli NI-easF<7gsr2H7F/@5

$#

^ 6. Risk Manager 3s]<MsHN@$"0i`


2.T

ivoli

Risk

Man

ager�

��

3liN=JN5]<HO"Risk Manager N+9?^<&5]<HNltH7FOs!5l

F$^;s#

9GK3liN,\N=Jr"5]<H&lYkG$s9H<k7F"klg"F$s9H<

kOTWG9#Risk Manager r$s9H<k9k0K"3liN=JN$s9H<krWh

7J1lPJj^;s#

Risk Manager � Tivoli Enterprise ConsoleTEC O"Tivoli Management Framework NGeLK8_7^9#TEC O"3NUl<`o<

/NL.5<S9Hjl<7gJk&G<?Y<9&$s?<U'<9r>N3s]<MsH

H&KHQ7^9#

Risk Manager O"J<N TEC 3s]<MsHrHQ7^9#

¶ TEC $YsH&5<P<#3lO"u.$YsHKk<kr,Q7^9#

¶ TEC $YsH&3s=<k&5<P<

¶ TEC $YsH&3s=<k

¶ "@W?<=.!= (ACF)

¶ "@W?<

Risk Manager O"1lN/~!N79F`&3s=<kG"k Tivoli Enterprise Console +

i"e-business N;-ejF#<eNj9/rI}7^9# TEC KX9k04JpsKD$

FO"Tivoli Enterprise Console NI-easF<7gsr2H7F/@5$#

TEC $YsH&3s=<kO"1l$YsH&3s=<kG"79F`I}H/~!NN>

}N$YsHrh}7^9#$YsHO"Tivoli Enterprise Console KhCFh}5lk>N

$YsHH18}!G=(5l^9#$YsHr18}!G=(9k3HKhj"TEC $Y

sH&3s=<kN*Zl<?<O=lirz(*Kh}9k3H,G-^9#

TEC O"Risk Manager X"N$YsHN}8"I}"*hSjXrHk?aNa+K:`r

s!7F$^9#15Z<8N^7 K"TEC 5<P<H3s=<kNX8r(7^9#

14 P<8gs 3 jj<9 8

Risk Manager O"Tivoli "I_K9Hl<?<,h}G-kh&KJ<N$YsHr}8

7"=lir$YsH&3s=<kK>w7^9#J<N$YsHN+F4j<K$YsH&

0k<WrjA9kh&"TEC r+9?^$:9k3H,G-^9#

¶ uV$YsH

¶ ;s5<&$s9?s9

¶ Hi9FCI&[9H+iN"/F#SF#<

¶ Risk Manager KhCF!P5lkc0

¶ 9YFN Risk Manager ;s5<&$YsH

Risk Manager $YsH&3s=<kO"MCHo</bN;s5<+iu.7?$YsHN

#gSe<r=(7^9#Risk Manager O$YsH&3s=<kK$YsHr=(7^9

,"$YsH&3s=<kGO$YsH&"/F#SF#<N#tNSe<,=(5l^9#

Risk Manager O$YsH&3s=<keG$YsH&0k<W*hS$YsH&U#k?<

rn.9k?aN$s]<H&U!$krs!7^9#

��TEC O"u.7? Risk Manager $YsHr"$YsH&G<?Y<9 HFPlkjl<7

gJk&G<?Y<9I}79F` (RDBMS) K]I7^9#

^ 7. TEC 5<P<H3s=<kNX8


2.T

ivoli

Risk

Man

ager�

��

TEC ��TEC $YsH&5<P<O"u1hC?9YFN$YsH*hSbtG8.5l?9YFN

$YsHNh}rI}7^9#e.$YsHO"$YsH&G<?Y<9K-?5l"k<

k&;CHK>CFh}5l^9#btG8.5l?$YsHO"18k<k&;CHK>C

Fh}5lF+i"$YsH&j]8Hj<K]I5l^9#k<kNBTfK"$YsHO

TEC $YsH&5<P<KwilFFh}5lk3H,"j^9#Fh}Ne"$YsH&

j]8Hj<bN(sHj<O",WK~8F975l^9#5iK TEC $YsH&5<P

<O"9YFN TEC $YsH&3s=<kr=_N$YsHpsG977^9#

Risk Manager O TEC $YsH&5<P<rHQ7F"/~!N$YsHNu."]I"*

hS`nrBT7^9#TEC $YsH&5<P<N\YKD$FO"Tivoli Enterprise

Console NI-easF<7gsr2H7F/@5$#

TEC ��Tivoli O"$YsHrU)<^CH7F"=lr TEC 5<P<Kw.9k?aNFQN

TEC "@W?<rs!7F$^9#Risk Manager "@W?<H;s5<O"Risk Manager $

YsHrU)<^CH7F=lr Risk Manager 5<P<K>w9k?aK"?/Nlg"

TEC "@W?<KM87^9#

"@W?<Oj=<9rI}G-kh&Kj=<9rbK?<7^9#"@W?<,bK?<

P]Nj=<9+i8.5l?$YsHr!P9kH""@W?<O=N$YsHrU)<^

CH7F"=lr Tivoli $YsH&5<P<Kw.7^9#"@W?<O"B]K$YsH

r8.7F$kbK?<P]Nj=<9+i$YsHru.9k3HbG-^97"=<9,

m0&U!$kraC;<8G979k?SK"=.D=J$s?<PkG ASCII m0&U

!$kr4Yk3HbG-^9#

"@W?<O"Tivoli $s?<U'<9 ^?O Tivoli J0N$s?<U'<9 rHQ7F"

$YsHr Tivoli $YsH&5<P<Kw.9k3H,G-^9#Tivoli $s?<U'<9

O"Tivoli Management Framework KhCFs!5lk5<S9rHQ7F"\3rN)7^

9#Tivoli J0N$s?<U'<9O"[9H>"^?O$s?<MCH&WmH3k (IP)

N"Il9A0JIN8`Wm;9VL.Na+K:`rHQ7F"\3rN)7^9#

(sI]$sHeK$s9H<k5l?"@W?<O"=N$YsHr(sI]$sH&2<

H&'$Kw.7^9#9kH"(sI]$sH&2<H&'$,=liN$YsHrPsI

k7F"Tivoli $YsH&5<P<K>w7^9#

(sI]$sHQK Risk Manager ,5]<H7F$k TEC "@W?<O"UNIX NlgO

Tivoli Logfile "@W?<"Windows 79F`NlgO Windows Event Log "@W?<G

9# SNMP "@W?<b5]<H5lF$^9#

m: \qGO""@W?<, Tivoli Logfile "@W?<"Windows Event Log "@W?<"^

?O SNMP "@W?<NIlG"k+rXj9keojK"mN*J TEC "@W?<

H$&QlrHQ7^9#

;s5<O$YsHr8.7"=lir,ZJm.s0!=rP39kh&KP)rja^

9#$YsHO=Nm.s0!=Khj",ZJ TEC "@W?<Gh}5l"TEC Kwi

l^9#Tivoli $YsH&5<P<GO"Risk Manager TEC Correlation k<krHQ7F"

jX,Tol^9#Risk Manager TEC Correlation O"IDS $YsHr+0*K0k<W=

16 P<8gs 3 jj<9 8

7"MCHo</N;-ejF#<uVr(9J1J^r=(7^9#57Z<8NXRisk

Manager Server CorrelationYr2H7F/@5$#

F TEC "@W?<KOi|$YsH&i$Vij<,U07F$^9#3Ni$Vij<

O"v0jA5l?$YsH&;CHKP7F90KHQD=J5]<Hrs!7^9#!N

U!$k,$YsH&i$Vij<r=.7^9#

BAROC U!$k (BAROC file)BAROC U!$kO$YsHr"k<k&;CHb+i$YsH&5<P<K,`7

^9#$YsH&/i9 HO$YsHNoLG9#p\*K"$YsH&/i9O"

"@W?<,INpsr$YsH&5<P<Kw.9k+rhj9k""@W?<H

Tivoli $YsH&5<P<HNVNgUv`G9#Risk Manager O"5]<H5lF

$k;s5<H"@W?<4HK BAROC U!$krs!7F$^9#\YKD$F

O"XBAROC U!$kYr2H7F/@5$#

U)<^CH&U!$k

3liN"@W?<KX9k$YsH&/i9NQ9OU)<^CH&U!$kGB

T5l"!K"=NU)<^CH&U!$k+i7,N/i9jA9F<HasH

(.cds) U!$k,8.5l^9#U)<^CH&U!$kO"$YsH&=<9+i

hj~^lkaC;<8NU)<^CHrjA7^9#U)<^CH&U!$kO"

TEC "@W?<QN/i9jA9F<HasH (.cds) U!$kr8.9klgKb

HQ5l^9#Risk Manager O"5]<H5lF$k;s5<H"@W?<4HKU

)<^CH&U!$k (.fmt) rs!7F$^9#

/i9jA9F<HasH&U!$k (.cds)TEC "@W?<O CDS U!$k (.cds) rHQ7F"D9N$YsHr$YsH&/

i9K^CW7"=N$YsH0-rjA7F+i"=N$YsHr$YsH&5<

P<K>w7^9# Risk Manager O SNMP "@W?<rHQ9k"@W?< (ISS

RealSecure Q"@W?<*hS Cisco k<?<Q"@W?<) K .cds U!$krs

!7^9#

3liNU!$krQ99k3HKhj"$YsHN/i9rIC"Q9"*hSXj9k3

H,G-^9#"@W?<H&Ks!5lF$ki|$YsH&i$Vij<O"3N"@W

?<KhCFh}5lk&L$YsHr5]<H7^9#^?"$YsH&i$Vij<O"

7,N$YsHjArn.9k?aNcbs!7F$^9#

BAROC �)��F"@W?<KO"TEC "@W?<,5]<H9k$YsHN/i9r-R7? BAROC U

!$k,U07F$^9#3NU!$kO TEC "@W?<=NbNKhCFHQ5lko1

GO"j^;s,""@W?<H$YsH&5<P<HNVN,\js/H7FNrdrL?

7^9#$YsH&5<P<O3NU!$krm<I7F+iGJ1lP""@W?<+iu

.7?$YsHr}r9k3H,G-^;s#BAROC U!$kKOLo .baroc NH%R,

U$F$^9#

Risk Manager BAROC U!$kO"TEC /i9,Xr-R7^9#9YFN/i9O

EVENT /i9+iQ57^9#Risk Manager NGeLNj]/i9"*hS3s]<MsH

TEC $YsH&/i9jAO"J<N=N BAROC U!$kK"j^9#

BAROC U!$kN>0 /i9N?$W

riskmgr.baroc jXKHQ5lk Risk Manager /i9#


2.T

ivoli

Risk

Man

ager�

��

BAROC U!$kN>0 /i9N?$W

sensor_abstract.baroc ;s5<KX"7?GeLNj]/i9#3liN/i9N$s9?

s9O TEC KOw.7J$G/@5$#3NU!$kbN3liN

/i9O"riskmgr.baroc U!$kbN/i9KM87F$^9#

sensor_generic.baroc "@W?<NW.J+/r%J9k?aKHQ5lkFQ/i9#3

NU!$kbN/i9O"sensor_abstract.baroc U!$kbN/i

9KM87F$^9#

realsecure.baroc ISS RealSecure Q"@W?<N[9H&Y<9*hSMCHo</&

Y<9N$YsH&/i9#3NU!$kbN/i9O"

sensor_abstract.baroc U!$kbN/i9KM87F$^9#

csids.baroc Cisco Secure IDS QN"@W?<N$YsH&/i9#3NU!$

kbN/i9O"sensor_abstract.baroc U!$kbN/i9KM8

7F$^9#

webids.baroc Web IDS $YsH&/i9#3NU!$kbN/i9O"


cpfw.baroc Check Point FireWall 1 Q"@W?<N$YsH&/i9#^?"3

liN$YsH&/i9O"$/D+NFQU!$"&)<k&$Y

sHrjA7F$^9#3NU!$kbN/i9O"


pix.baroc Cisco Secure PIX Firewall Q"@W?<N$YsH&/i9#^?"

3liN$YsH&/i9O"$/D+NFQU!$"&)<k&$

YsHrjA7F$^9#3NU!$kbN/i9O"


os.baroc Host IDS Q"@W?<N$YsH&/i9#3NU!$kbN/i

9O"sensor_abstract.baroc U!$kbN/i9KM87F$^

9#

crouter_snmp.baroc Cisco k<?<Q"@W?<N$YsH&/i9#^?"3liN$

YsH&/i9O"FQk<?<&$YsHrjA7^9#3NU!

$kKO"Cisco k<?<QN/i9NI8*,^^lF$^9#3

NU!$kbN/i9O"sensor_abstract.baroc U!$kbN/i

9KM87F$^9#

rmvirus.baroc Norton AntiVirus N$YsH&/i9QN"@W?<H McAfee

Alert Manager QN"@W?<#^?"3liN$YsH&/i9

O"FQ"sA&#k9&$YsHrjA7^9#

3NU!$kbN/i9O"sensor_abstract.baroc U!$kbN/

i9KM87F$^9#

nids.baroc Risk Manager Network IDS N$YsH&/i9#3NU!$kbN

/i9O"sensor_abstract.baroc U!$kbN/i9KM87F$

^9#

�*��$��)��"@W?<O .cds U!$krHQ7F"u1hC?D9N$YsHrCjN/i9K^CW

7"$YsHN0-rjA7F+i"$YsHr$YsH&5<P<K>w7^9#.cds U

!$kO"3NU!$krHQ9k"@W?<,5]<H9k$YsH&/i94HK"

SELECT"FETCH"*hS MAP 9F<HasHrXj7^9#[HsIN"@W?<GO3

NU!$k,,WG9#=N?a"3NU!$kNU)<^CHO"3lrHQ9kIN"@

18 P<8gs 3 jj<9 8

W?<Gb1lNbNHJCF$^9#Xj5lF$k$YsH&/i9O9YF"

sensor.abstrac.baroc N/i9+iI87?p\/i9+i,ZKI87F$J1lPJj

^;s#

.cds U!$kbN$YsHjArQ99klgO"Basic Recorder of Objects in C (.baroc)

U!$kbNP~9k$YsH&/i9jAbQ99k,W,"j^9#VTivoli Event

Integration Facility f<6<:&,$IWGO"$YsHjANbF*hS=8rrb7^

9#

lLK""@W?<rBT9kh&K .cds U!$krQ99k,WO"j^;s#J<J

i"3NU!$kOU)<^CH&U!$k+i8.5lk+iG9 (XU)<^CH&U!

$kYr2H)# Tivoli GO"/i9jA9F<HasH&U!$krn.9k?aKHQ9

k tecad_logfile.fmt"tecad_nt.fmt"*hS tecad_win.fmt U!$krs!7F$^9#

Risk Manager U)<^CH&U!$kO"GU)kHN TEC U)<^CH&U!$kNv

xKUC5l^9#"k$O"GU)kHN TEC U)<^CH&U!$krV-9(k3H

,G-^9#

Risk Manager O"TEC SNMP "@W?<H&KHQ9k/i9jA9F<HasH&U!$

krs!7^9#tecad_snmp.cds U!$krHQ7F"Internet Security Systems RealSecure

ISS RealSecure *hS Cisco k<?<KhCF8.5l?$YsHrhj~`h&K SNMP

"@W?<r=.7^9#

� �!+��)��HQ7F$k"@W?<KU)<^CH&U!$k,,WJlgKO"J<N$:l+ 1 D

rT$^9#

¶ Risk Manager U)<^CH&U!$kr TEC "@W?<NU)<^CH&U!$kKU

C7F"2 DNU!$kr^<87^9#

¶ *j8JkN TEC "@W?<NU)<^CH&U!$kNbFr"Risk Manager U)<

^CH&U!$kNbFGV-9(^9#Host IDS QN"@W?<NlgO"3lO,\

N9FCWG9#

48Z<8Ncr2H7F/@5$#

TEC SNMP "@W?<KO .cds U!$k,,WG9#

TEC "@W?<O79F`&m0&aC;<8+ipsrjP7^9#3NU)<^CH*

hSU#O}-/Qok3H,"j^9#

aC;<8r$YsH&/i9KM-go;k,W,"j^9#3N?$WNM-go;O"

U)<^CH&U!$k GTol^9#Lo"U)<^CH&U!$kKO".fmt H$&H

%R,U$F$^9#U)<^CH&U!$kO!N\*N?aKHQ7^9#

¶ aC;<8H$YsH&/i9N^CAs0N?aN!wU!$kH7F#lW9kbN

,J$lgKO"$YsH,Q~5l^9#

¶ .cds U!$kN8.~N~OH7F (18Z<8NX/i9jA9F<HasH&U!$

kYr2H)#


2.T

ivoli

Risk

Man

ager�

��

Risk Manager U)<^CH&U!$kKO"!NbN,"j^9#

= 3. Risk ManagerU)<^CH&U!$k

Risk Manager U)<

^CH&U!$k

Risk Manager "@W?<

"@W?<&?$W WiCHU)<`

webids.fmt Web IDS Risk Manager EIF Unix *hS Windows

79F`

Logfile "@W?< Unix 79F`

webids.nt.fmt Web IDS Windows Event Log "

@W?<

Windows 79F`

pix.fmt Cisco Secure PIX

Firewall Q"@W?<

Tivoli Logfile "@W?

<

UNIX 79F`

pix_nt.fmt Cisco Secure PIX

Firewall Q"@W?<

Windows Event Log "

@W?<

Windows 79F`

csids.fmt Cisco Secure IDS Q"

@W?<

Risk Manager EIF Unix *hS Windows

79F`


csids.nt.fmt Cisco Secure IDS Q"

@W?<

Windows Event Log "

@W?<

Windows 79F`

os_aix.fmt Host IDS Q"@W?< Logfile "@W?< AIX 79F`

os_solaris.fmt Host IDS Q"@W?< Logfile "@W?< Solaris 79F`

os_nt.fmt Host IDS Q"@W?< Windows Event Log "

@W?<

Windows 79F`

os_linux.fmt Host IDS Q"@W?< Logfile "@W?< Linux 79F`

rnmac.fmt McAfee Alert Manager

Q"@W?<

Windows Event Log "

@W?<

Windows 79F`

rmnav.fmt Norton AntiVirus Q"@

W?<

Windows Event Log "

@W?<

Windows 79F`

cpfw.fmt Check Point FireWall-1

Q"@W?<

Risk Manager EIF Unix *hS Windows

79F`


cpfw.nt.fmt Check Point FireWall-1

Q"@W?<

Windows Event Log "

@W?<

Windows 79F`

tecad_snmp.cds Cisco Router"ISS

RealSecure Q"@W?<

SNMP "@W?< Unix *hS Windows

79F`

m: Cisco k<?<*hS ISS RealSecure Q"@W?<O Tivoli SNMP "@W?<rHQ7

^9#3N"@W?<O"tecad_snmp.cds N Risk Manager P<8gsrHQ7F=.

9k,W,"j^9#

U)<^CH&U!$kO"P~9k BAROC U!$kH1|5;F*+J1lPJj^;

s#U)<^CH&U!$kN=$O18G9#GiN$/D+NU)<^CHOFQjA

G"=liOINaC;<8HblW7^;s#H$&NO"B]N IDS =JaC;<8H

M-go;k?aNFsWl<HH7F"3liNU)<^CHrHQ9k?aG9#

Risk Manager U)<^CH&U!$kN$:l+NbFr=(9kKO"4HQNWiCH

U)<`N!NG#l/Hj<bN Tivoli $YsH&5<P<eK"kU)<^CH&U!

$k (.fmt) r2H7F/@5$#

$BINDIR/../generic_unix/RISKMGR/ACF_REP

20 P<8gs 3 jj<9 8

BINDIR O"$YsH&5<P<&P$Jj<,$s9H<k5lF$kljG9#


2.T

ivoli

Risk

Man

ager�

��

22 P<8gs 3 jj<9 8

Tivoli Enterprise Console ��

3NOGO"Tivoli Enterprise Console (TEC) G Risk Manager NuV,INh&K=(5l

kN+KD$Fb@7^9#^?"CjN$YsHKX9kpsNh@}!KD$Fbb@7

^9#

Risk Manager Web Intrusion Detection System (IDS) ��,�3NOGO"/3j@k7Jj*KD$Frb7^9#Risk Manager O"Risk Manager Web

IDS rHQ9k$/D+N Web 5<P<rbK?<7F$kbNH7^9#3N7Jj*G

O"6b,/87?lgK?,/3k+KD$FJ1Jb@r7"6bGz-/35l?/~

!N$YsHr=(9k TEC NHQ}!r(7^9#>N Risk Manager ;s5<*hS5

<I&Q<F#<NTN=JKhCF!P5l?6bb1MN"Wm<ArHQ7F=(9k

3H,G-^9#

6b,TolkH?,/3kNG7g&+#Risk Manager Web IDS ;s5<O"Web 5<

P<6br!P9k?aK"Web 5<P<KhCF8.5lk"/;9&m0&U!$kr

,O7^9#Web IDS O"N1Y<9N"Wm<ArHQ7F"Web 5<P<6bNFQ7

0KAc<rjA9k3HKhj"?o7$6kq$r!P7^9#3liN70KAc<

O"-OOJ6br!P9k?aKHQ5l^9#Web IDS ;s5<O"?o7$"/F#

SF#<KP9k~zH7F TEC $YsHr8.7"=N$YsHr TEC 5<P<Kwj

^9#

3N7Jj*GO"Web IDS , Apache Web 5<P<KP9k6br!P7"#tN/~!

N$YsHr TEC 5<P<KLN7^7?# IDS ;s5<&$YsHr TEC ,u.9k

H"$YsHjX(s8s,=liN$YsHr,O7F"6bQ?<sr57^9# TEC

jX(s8sO"Risk Manager KhCFs!5lF$k TEC k<k&;CHH7F$sW

jasH5lF$^9#

Risk Manager jXO"6bQ?<sr!w9klgK"3 DN-<rHQ7^9#GiN-

<O"$YsH&/i9N+F4j<G9#Risk Manager O"Web 6b"Hm$NZO"5

<S96b"5<S982"*hS&#k9N"/F#SF#<JI"$/D+N?$WN?

o7$"/F#SF#<r+F4j<=7F$^9#3N7Jj*GNGiN-<"9JoA

+F4j<O"Web 6bG9#2 D\N-<O"8h[9H>^?O IP "Il9G"3 V

\N-<O"=<9N[9H>"k$O IP "Il9G9#

jX(s8sO"3li 3 DNG<?&-<H3liN-<NH_go;KpE$F$Ys

Hr8s7"7-$M"k4j:`KpE- TEC K"i<`r8.7^9#"i<`O u

V HFPl^9#FuVKO"EgY,X"U1ilF$^9#EgYO"?o7$"/F

#SF#<,3$F$klg"0*Ke2""/F#SF#<,E^C?lg"<2k3H,

G-^9# Risk Manager NuVO"!Nh&KFQ-Nc$g+ijA5lF$^9#

3


3.T

EC��

��

��

uV 1$YsHOGbBj*G"+F4j<"8h[9H"*hS=<9&[9HN 3 DN

-<9YFKlW9k$YsH+i8.5l^9#

uV 2$YsHO"2 DN-<@1KlW9k$YsH+i8.5l^9#$YsHO"$

UN 2 DN-<KlW7^9#

uV 3$YsHO"1 DN-<KN_lW9k$YsH+i8.5l^9#

uV 1 N$YsHO"1 DN=<9+i 1 DN8hXNsoKEgJ6br(7F$k3H

,"j^9#uV 3-3 N$YsHO"#tN=<9+i#tN8hXNCjN6b?$Wr

=7F$^9#3li 2 DJ0Kb"+F4j<"8h[9H"*hS=<9&[9HNH

_go;KhCFICN6b?$W,=5l^9#

TEC ��^8 O"TEC $YsH&0k<WK0k<W=5lk Risk Manager N$YsHr0iU#

C/=(7? TEC NSe<G9#

VRM Events (RM $YsH)W0k<WKO"u1hC? Risk Manager ND9N;s5<&

$YsH,9YF^^l^9#3N7Jj*GNl"N Web 6bKhj"27 ND9N$Y

sH, TEC 5<P<Kwil^9#VRM Situations (RM uV)W0k<WKO"?o7$"

/F#SF#<KpE-jX(s8s,8.7?9YFNuV$YsH,^^l^9#3N7

Jj*GO"1 DNuV,8.5l^9#3NuVNEgYO/jF#+k HJj^9#

b& 1 DN$YsH&0k<WKO"VRM Trusted (RM Hi9FCI)W,^^l^9#3

lKO"Hi9FCI&[9HH7FXj5lF$k;s5<+iu1hC?$YsH,^^

l^9#Hi9FCI&[9HrXj9kH"spJ7[o (false positive) Nt,G.KJ

j^9#VRM Sensor (RM ;s5<)W0k<WKO;s5<N$s9?s9,^^l"

VRM Exceptions (RM c0)W0k<WKO Risk Manager (i<rsp9k$YsH,^^

l^9#

^ 8. TEC Se< -- P<&Ac<H

24 P<8gs 3 jj<9 8

��-#��VRM Events (RM $YsH)WP<r/jC/7F$YsH&Se<"<r)Ae2"u1h

C?9YFN Risk Manager $YsHr=(7^9# ^9 O"u1hC?$YsHNcr(

7?bNG9#

#tN Web 6b,/87F$^9#3liN6bO"1 DN=<9&[9H+i 1 DN8

h[9HKP7F/87?bNG9#9YFN6bO"18"@W?<&[9H ApacheServer

K~1ilF$^9#Web 6bN?$WO"$YsH&/i9> WW_InsecureCgi G=5l

^9#5V/@sO"6b, Web IDS KhCF!P5l?3Hr(7F$^9#0N Risk

Manager uVNb@KpE-"3N"37?6bKhj"uV 1 N$YsH,8.5l^

9#$YsHNt,3N6b+F4j<"D^j"18=<9&[9H+i188h[9HK

P9k6bN$YsH7-$Mr6(F$k+iG9#

TEC 3s=<kK=(5lF$k hostname 0-KO"6br}r9kNKr)DJ<Nh

&J-WJps,^^lF$^9#

¶ J1JA0Khk6b+F4j<Nb@#3NcGO"+F4j<O WEB G9#

¶ $YsHr8.7?;s5<N[9H>^?O IP "Il9#3NcGO"ApacheServer

, Web IDS "@W?<,os7F$k Web 5<P<N[9H>G9#

¶ 6bN=<9N[9H>^?O IP "Il9#3N7Jj*GO"[9H>O SourceHost

G9#

¶ 6bN8hN[9H>^?O IP "Il9#3NcGO"[9H>O DestHost1 G9#

l]<HKO"J<Npsb^^lF$^9#

EgY (Severity)TEC $YsHNEgY#

/i9 (Class)$YsHN/i9>#

^ 9. TEC $YsH&Se<"<


3.T

EC��

��

��

[9H> (Hostname)hostname 0-KX9ke-Npsr^sG$^9#

aC;<8 (Message)$YsHrb@9kJ1JaC;<8^?O70KAc<#

/@ (Origin)"@W?<N IP "Il9#

"@W?<&[9H (Adapter Host)"@W?<N[9H>#

5V/@ (Suborigin);s5<^?O"@W?<N>0#3N7Jj*GO"webids ,?(ilF$^9#

u7 (Status)$YsHN TEC u7#Risk Manager O";s5<N$YsHr*<WsuVN^^

K7^9#

/8~o (Time Occurred)$YsH,8.5l?~o#

+jV7st (Repeat_count)$YsH, Risk Manager Event Integration Facility KhCF8.5l?Ws$YsH

NlgKO"<mJ0NMK_j7^9#<mJ0NMO"Ws$YsHG=5lk

D9N;s5<&$YsHNtr=7^9#

M,<mNlgO"$YsH,Ws$YsHGOJ$3Hr(7F$^9#FWs$

YsHO"rm_Level H$&Mb}CF$^9 (3lO""@W?<=l+NG_j

5lk+"GU)kHGO"@W?<N baroc U!$k+i_j5l^9)#Ws$Y

sH, Risk Manager 5<P<Gu.5lkH"Risk Manager 5<P<O3N$Ys

HN rm_Level ,J<KJkh&K3NMr407^9#

(1 + repeat_count) * (rm_Level ��)

?H(P"repeat_count M, 299 G"GU)kHN rm_Level , 0.5 NWs$Ys

HN rm_Level 0-O 150.0 K_j5l^9#

rm_Level 0- (uV$YsHr8.9k+I&+H$D8.9k+"*hS=NE

gYlYkrhj7^9) Khj"uVN7-$MK#7F$k+I&+,h^j^

9#

m: repeat_count 0-KO"-1 G=5lk$YsHt,^^lF$^9# 2 DN$

YsH, 1 DNWs$YsHKWs5lF$klgO"=N repeat_count M

O 1 KJj^9#

Risk Manager ��TEC KaCF Risk Manager uV$YsH&0k<Wr*r7"9YFN Risk Manager uV

r(7F$k$YsH&Se<"<r=(7^9#

26 P<8gs 3 jj<9 8

^10 O"uV 1 N$YsHG"k RM_Situation1 ,8.5lF$k3Hr(7^9#3N$

YsHO"?tN$YsH,/87?3Hr(7F$^9#$YsHtO 1 DN=<9&[

9H (SourceHost) +i 1 DN8h[9H (DestHost1) KP7F/87?1lN6b+F4j

< (Web 6b) N$YsH7-$Mr6(F$^9#uV 1 $YsHNEgYO"=N$Y

sH, 1 DN8hKP9k8f6br(7F$kNG"/jF#+k KJj^9#

�,��5iK6b,}C7?lgOINh&KJkG7g&+#

3N187Jj*rQ97F"LNkLr(93H,G-^9#Web IDS ;s5<,"LN

Apache Web 5<P<eGLN Web 6bN;CH,/87?3Hr!P7?H[j7^9#

3liN Web 6bO0N6bN;CHH186b+F4j<G"18=<9&[9H+i/

87F$^9,"LN8h[9HK6bN7h,~1ilF$^9#

3liNl"N6bK~z7F"jX(s8sO 2 DNICu7$YsHr8.7^9#

1 DN=<9&[9H (SourceHost) +i/87"1 DN8h[9H (SourceDest2) r?<2C

HH9k186b+F4j< (Web 6b) N$YsH7-$Mr6(k?tN$YsH,/8

7?NG"2 V\Nu7 1 N$YsH,8.5l^9#

3liN$YsHOGiN6b;CHN8h[9H (DestHost1) HO[Jk8h[9H

(DestHost2) KP7F~1il?NG"u7 2 N$YsHb8.5l^9#3liOGiN6

b;CHH18+F4j< (Web 6b) G"18=<9&[9H (SourceHost) +i8.5l

^9#

^ 10. uV 1 *hS RM uV 1 r(7F$k TEC


3.T

EC��

��

��

3 DNjX-<Nb 2 D@1,3liN$YsHKlW7^9 (+F4j<H=<9)# ^11

O"3lKP~7F"uVH;s5<&$YsHNt,}(F$k3Hr(7F$^9#

TEC ��-#��Risk Manager uV$YsH&0k<Wr*r7^9#$YsH&Se<"<O"3 DNuV

$YsHr9YF)Ae2"=(7^9#

^ 11. RM uVN}Cr(7F$k TEC

28 P<8gs 3 jj<9 8

RM_Situation1 $YsHNVHostname ([9H>)WO"6bNCjN=<9H8hr(7F$

^9#

RM_Situation2 $YsHNVHostname ([9H>)WO"#tN8h[9Hr?<2CHH9k

1 DN=<9&[9Hr(7F*j"aC;<8&U#<kIK"lW9k 2 DNjX-<

,+F4j<H=<9G"k3Hr(7"6bN?$Wr=(7F$^9#

RM_Situation2 $YsHr*r7F"uV$YsHN0- (30Z<8N^13 Ncr2H) r^

`"uV$YsHKX9k\YpsN\YSe<r=(7^9#0-O"uV$YsHK&L

N\Yr=7^9#

^ 12. TEC $YsH&Se<"<K=(5l? 3 DNuV$YsH


3.T

EC��

��

��

^ 13. TEC $YsH&Se<"<K=(5l?$YsH 1 N\Y

30 P<8gs 3 jj<9 8

Risk Manager Web ��CjNuV$YsHKX89kqN*J;s5<&$YsHKD$FNpsKb=#,"kG

7g&#?H(P"3N7Jj*GO"RM_Situation2 $YsHKX89k;s5<&$Ys

HKD$FN\YpsK=#,"kG7g&#3Npsr=(9kKO"J<Nh&K7^

9#

1. Risk Manager uVSe<"<Kaj"RM_Situation2 $YsHr*r7^9#

2. RM_Situation2 $YsHr&/jC/7F^14 K(7?]CW"CW&&#sI&r=(

7^9#^?O"LN}!H7F"RM_Situation2 $YsHr*r7"VInformation (ps)Wr/jC/9k3HbG-^9#

3. 3lKhj"GU)kHN Web Vi&6<H"uV$YsHKX9kICpsr(7?

Web Z<8,m<I5l^9#J<Nps,=(5l^9#

RM_Situation2 $YsHHOuV 2 N$YsHNjA,=(5l^9#

ICpsr!wG-klj

*si$s&I-easF<7gsXNjs/#

3Nu7KX89kD9N$YsH

3Nu7KX89k$YsH&;CHr=(9kKO";s5<&$YsH4H

K"4Yk,WN"kqN*J0- (J<r2H) r*r7^9#

¶ Class

¶ Date_Event

¶ Severity

¶ SensorHostname

¶ SourceHostname

¶ SourceIPAddr

¶ SourcePort

¶ DestinationHostname

¶ DestinationIPAddr

^ 14. TEC $YsH&Se<"<K=(5l?6bKX9kps


3.T

EC��

��

��

¶ DestinationPort

¶ ClassCategories

¶ Subsource

¶ Message

¶ Signature

VSubmit (h}Mj)Wr/jC/7^9#

^15 K(9h&K"Web Z<8KO"*r5lF$ku7$YsHKX89kD

9N;s5<&$YsH,=(5l^9#

^ 15. *r5lF$kuV$YsHKX89kD9N;s5<&$YsHNc

32 P<8gs 3 jj<9 8

Risk Manager ��

3NOGO"Risk Manager 3s]<MsHN$s9H<k}!KD$Fb@7^9#$s9

H<kr+O9k0K"VTivoli Risk Manager jj<9&N<HWr2H7F"=UH&'

"*hSO<I&'"WoKX9kICps"*hS Risk Manager KX9k$s9H<kp

sNQ9@r4YF/@5$#

$s9H<k&aC;<8KD$FO"253Z<8NX$s9H<k&aC;<8Yr2H7

F/@5$#Risk Manager Server NaC;<8KD$FO"263Z<8NXRisk Manager 5

<P<NaC;<8Yr2H7F/@5$#

\qGO"J<N$s9H<kjgO7CF$^;s#

¶ 0sroHJk Tivoli =J

¶ Tivoli Management Enterprise (TME) "@W?<

¶ Tivoli Enterprise Console (TEC) U)<^CH&U!$k*hS/i9jAU!$k

¶ 5<I&Q<F#<N;s5<&"Wj1<7gs

3NOGO"3liN5<I&Q<F#<=;s5<&"Wj1<7gsQ Risk Manager "

@W?<N$s9H<k}!KD$Fb@7^9#

��$s9H<krOak0K"$s9H<k9k=JH"=Jr$s9H<k9k79F`KD

$F!$7F/@5$#$s9H<kGO"=NgxKmU9k,W,"j^9#Lo""@

W?<r$s9H<k9k0K;s5<r$s9H<k7^9#F3s]<MsH4HN$s

9H<kgxK>CF/@5$#

Risk Manager =JKO"0sroHJk Tivoli =J,^^lF$^;s# Risk Manager r

$s9H<k9k0K"3liN Tivoli =Jr$s9H<k7J1lPJj^;s#{8N

Tivoli =J,57$lYkG"lP"=N=JrHQ9k3H,G-^9#

��Risk Manager GO"#tN$YsH&5<P<,5]<H5l^9##tN$YsH&5<

P<rHQ9kH"(s?<Wi$:N?tN+9?^<,#tN Tivoli I}j<8gs

(TMR) r;CH"CW9k3H,G-^9#MCHo</N[JkNhN TMR 4HK 1 D

N$YsH&5<P<,,WG9#

$YsH&5<P<r,XT.G[V9kH"#tN$YsH&5<P<NVGjXh}r,

69k3H,G-^9#^?"Risk Manager KhCF8.5lkuV"i<HN8f=(b

D=KJj^9#

4


4.R

iskM

anag

er��

��

<LN=l>lN$YsH&5<P<O"u.7?$YsHKP7FjXrBT7"eLN$

YsH&5<P<KuVG<?r>w7^9#eLN$YsH&5<P<O"uVG<?ru

.7",9"$YsH&3s=<kGuV$YsHr=(7^9#

#tN5<P<rHQ9klg"$YsHNh},,65lk3HKhj"91<iSjF#

<,~e7^9#

LN5<P<Kpsr>wG-kh&K9kKO"73Z<8NXuVG<?N>wYr2H7

F/@5$#

m: F Tivoli Enterprise Console (TEC) $YsH&5<P<O",:=N TMR NasP<G

J1lPJi:"=l>lN$YsH&5<P<,+iNG<?Y<9&$s9?s9r

}D,W,"j^9#

Risk Manager N$YsHjX5<P<&3s]<MsHO",XT.bN=l>lN TEC

5<P<K$s9H<k7J1lPJj^;s#

��$s9H<kgxN5WrJ<K(7^9#

Risk Manager ��,WJlYkN3li=J,$s9H<kQ_Nlg"F$s9H<kN,WO"j^;s#

^@$s9H<k7F$J$lgO"J<N=Jr!K(9gxG$s9H<k7F/@5

$#

1. Tivoli Management Framework (J0N TME/10 Management Enterprise Framework)"P<

8gs 3.7.1

m: TEC 5<P<O"Tivoli Management Framework P<8gs 3.7.1 r$s9H<k7

?79F`eK$s9H<k7J1lPJj^;s#

^ 16. "<Ho</: #tN$YsH&5<P<N^

34 P<8gs 3 jj<9 8

2. Tivoli Management Agent (sI]$sH&=UH&'" (J0N LCF (sI]$sH)"

P<8gs 3.6.3 J_#

3. $YsH&G<?Y<9H7FHQ9k0tjl<7gJk&G<?Y<9I}79F`

(RDBMS)

$YsH&G<?Y<9O"TEC HOLDK$s9H<k7^9#TEC r!=5;k?

aKO"$YsH&5<P<H18[9HeK RDBMS /i$"sH&=UH&'"r$

s9H<k7J1lPJj^;s#Tivoli Management Framework N RDBMS Interface

Module (RIM) 3s]<MsHrHQ7F"G<?Y<9K"/;97^9#$YsH&G

<?Y<9N\YKD$FO"Tivoli NqAr2H7F/@5$# Risk Manager O"!

NG<?Y<9r5]<H7^9#

¶ IBM DB2 P<8gs 6.1, 7.1

¶ Oracle Database G<?Y<9 8.1.x

¶ Sybase Adaptive Server Enterprise (ASE) P<8gs 11.5"11.9x"*hS 12.0

4. TEC P<8gs 3.7.1

¶ TEC P<8gs 3.7.1 $YsH&5<P<

¶ TEC P<8gs 3.7.1 f<6<&$s?<U'<9 (UI) 5<P<

¶ TEC P<8gs 3.7.1 $YsH&3s=<k

¶ Tivoli "@W?<=.!= (ACF) P<8gs 3.7.1

ACF Khj""@W?<N=.U!$krT87F"=.U!$kN3T<r#tN

(sI]$sHKw.9k3H,G-^9#=.,wF$k79F`K#tN;s5

<&"Wj1<7gs&$s9?s9,"klg"ACF rHQ9kHz(*G9#

ACF O"TME "@W?<r$s9H<k9k(sI]$sHK2<H&'$&5<

S9rs!7^9#TEC $YsH&5<P<eKO"@W?<r$s9H<k7J$

G/@5$#=NeojK""@W?<r TEC $YsH&5<P<+i[[7F/@

5$#WmU!$krHQ7F"@W?<r[[9klg""@W?<=.!=

(ACF) r$s9H<k9k,W,"j^9#

m: ACF O Tivoli I}j<8gs (TMR) *hS(sI]$sH&2<H&'$eK

$s9H<k7J1lPJj^;s#

¶ ,ZJ TME "@W?< ]!Risk Manager Event Integration Facility rHQ7F$J

$lg

v Tivoli Logfile "@W?< (syslogd) (UNIX 79F`Q)

v Windows Event Log "@W?<

v SNMP "@W?< (UNIX 79F`^?O Windows 79F`Q)

5. ;s5<&"Wj1<7gs (,WK~8F 1 D^?O#t)#

6. Tivoli Decision Support P<8gs 2.1.1 ] Tivoli Decision Support for Enterprise Risk

Management ,$IrHQ9klg


4.R

iskM

anag

er��

��

Risk Manager Event Integration Facility ��Risk Manager Event Integration Facility (Risk Manager EIF) GO"Java Runtime Environment

(JRE) P<8gs 1.3 ,,WG9#

Windows 79F`:

Windows $s9H<k&QC1<8KO",\lYkN JRE rHQ9k?aK$s9H<k

7J1lPJiJ$3s]<MsH,^^lF$^9#

AIX 79F`:

AIX Nlg"QC1<8 Java130.rte , Risk Manager EIF N0sroHJj^9#3NQ

C1<8O"Risk Manager CD N usr/sys/inst.images G#l/Hj<K"j^9#

Java 1.3 KO"AIX *Zl<F#s0&79F`G bos.rte P<8gs 4.3.3.10 J_,,W

G9#3NQC1<8r$s9H<k9kKO"lgKhCFO AIX *Zl<F#s0&7

9F`r"CW0l<I9k,W,"j^9#,WH5lk"CWG<HKD$FO"IBM

5<S9*hS!N Web 5$H^G*d$go;/@5$#

http://techsupport.services.ibm.com/eserver/fixes

Solaris 79F`:

Solaris Nlg"Risk Manager EIF KO SUNWj3rt Java is?$` QC1<8,,WG

9# SUNWj3rt QC1<8O"!N Sun Java Web 5$H+i~j9k3H,G-^9#

http://java.sun.com

Linux 79F`:

Linux GO"Risk Manager EIF KO IBMJava2-JRE QC1<8"P<8gs 1.3 J_,,

WG9#3NQC1<8O"Risk Manager CD N linux_client G#l/Hj<K"j^

9#

Risk Manager ��'��(�Tivoli Risk Manager 3.8 =JGO"=N CD NeLG#l/Hj<K$/D+NU!$k&

QC1<8,^^lF$^9# 37Z<8NX$s9H<k*hS=.}!N5WYO"Risk

Manager 3s]<MsHH=N$s9H<k}!NWsr(7^9#

��.��+/�0

¶ Tivoli Risk Manager 5<P< 3.8

Risk Manager 5<P<NQC1<8KO"Risk Manager "@W?<=.U!$k,^^

l^9#ACF rHQ7F"$YsH&"@W?<r=.*hS+9?^$:7"I}P]

(sI]$sHK[[9k3H,G-^9#3liN=.U!$kO"ACF Keok"@

W?<N$s9H<k}!H7F"Risk Manager G-N$s9H<k&QC1<8Kb^

^lF$^9#

36 P<8gs 3 jj<9 8

¶ Tivoli Risk Manager Perl 5]<H 3.8

3NQC1<8r"Tivoli I}P]N<I"Tivoli (sI]$sH"^?Os Tivoli (s

I]$sHK$s9H<k7^9#

Web IDS"Risk Manager s!N TEC ?9/ (Cisco Secure PIX Firewall Q"@W?<G

HQ)"^?O Risk Manager Event Integration Facility Perl $s?<U'<9r$s9H

<k7FHQ9kKO"Perl 5]<H&QC1<8,,WG9#

Risk Manager ��+/�0

Tivoli Risk Manager Event Integration Facility 3.83NQC1<8r Tivoli D-^?Os Tivoli D-N(sI]$sHK$s9H<k

7^9#I}P]N<IGNHQO5]<H5lF$^;s#

Tivoli Risk Manager Web Intrusion Detection System 3.83NQC1<8r Tivoli D-^?Os Tivoli D-N(sI]$sHK$s9H<k


Tivoli Risk Manager "@W?< (Cisco Secure IDS 3.8 Q)3NQC1<8r Tivoli D-^?Os Tivoli D-N(sI]$sHK$s9H<k


Tivoli Risk Manager "@W?< (Check Point FireWall-1 3.8 Q)3NQC1<8r Tivoli D-^?Os Tivoli D-N(sI]$sHK$s9H<k


Tivoli Risk Manager Network Intrusion Detection System 3.83NQC1<8r Tivoli D-N(sI]$sHeK$s9H<k7^9#I}P]N

<IGNHQO5]<H5lF$^;s#

��=4 K"D=J$s9H<k}!NWsr(7^9#

= 4. $s9H<k*hS=.}!N5W

Risk Manager3s]<MsH

$s9H<k}!

TEC "@W?<

^?O RM EIFN?$W

U)<^CH&

U!$k^?O

.cds U!$k

TivoliG9/HCW

(sI]$sHX

NG-N

$s9H<k

(sI]$sHe

N ACF

5<P< "j -

Perl Support "j "j -

Risk ManagerEIF "j - rmad.fmt

Check Point

FireWall 1 Q

"@W?<

"j Risk Manager EIF

/ Logfile "@W

?<^?O

Windows Event

Log "@W?<

cpfw.nt.fmt cpfw.fmt


4.R

iskM

anag

er��

��

= 4. $s9H<k*hS=.}!N5W (3-)

Risk Manager3s]<MsH

$s9H<k}!

TEC "@W?<

^?O RM EIFN?$W

U)<^CH&

U!$k^?O

.cds U!$k

TivoliG9/HCW

(sI]$sHX

NG-N

$s9H<k

(sI]$sHe

N ACF

Cisco Secure IDS

Q"@W?<

"j Risk Manager EIF

/ Logfile "@W

?<^?O

Windows Event

Log "@W?<

csids.fmt csids.nt.fmt

Host IDS "j "j Logfile "@W?

<^?O

Windows Event

Log "@W?<

os_nt.fmt"os_aix.fmt"

os_solaris.fmt"

os_linux.fmt

McAfee Alert

Manager Q

"@W?<

"j "j Windows Event

Log "@W?<

rmmac.fmt

Norton AntiVirus

Q"@W?<

"j "j Windows Event

Log "@W?<

rmnav.fmt

Web IDS "j Risk Manager EIF

/ Logfile "@W

?<^?O

Windows Event

Log "@W?<

webids.fmt ^?O

webids.nt.fmt

Cisco Secure PIX

Firewall Q

"@W?<

"j "j Logfile "@W?

<^?O

Windows Event

Log "@W?<

pix.fmt ^?O

pix_nt.fmt U)<^C

H&U!$k

ISS RealSecure Q

*hS Cisco

k<?<Q"@W

?<

"j "j SNMP "@W?

<

tecad_snmp.cds *hS

tecad_snmp.oid U!$

k

Tivoli Decision

Support

InstallShield

Network IDS "j "j Logfile "@W?

<

nids.fmt

G-N$s9H<k}!:

¶ installp (AIX Nlg)

¶ pkgadd (Solaris Nlg)

¶ RPM (Linux Nlg)

¶ InstallShield Wm0i` (Windows 79F`Nlg)

38 P<8gs 3 jj<9 8

Tivoli ��+�� Risk Manager '��(��

Tivoli G9/HCWrHQ7F"!N Risk Manager 3s]<MsHr$s9H<k9k3H

,G-^9#

¶ Risk Manager 5<P<

¶ Risk Manager Perl 5]<H

VTivoli Enterprise Console f<6<:&,$IWK-R5lF$k"8` Tivoli G9/HC

WjgK>CF/@5$#

Risk Manager ��&�UNIX 79F`GO"Risk Manager EIF G$s9H<k5l?!ND-9/jWHr=<9

H7FHQ9k3H,G-^9#

/etc/Tivoli/rma_eif_env.sh

3N9/jWHO"Risk Manager D-Qtr_j7F"Risk Manager N bin G#l/Hj<

rQ9KIC7^9#Risk Manager EIF D-9/jWHN=<9r]$sH9kH"!Nh

&KJj^9#

¶ RMADHOME Qt,"U!$k,$s9H<k5lF$k Risk Manager G#l/Hj<

rX7^9#

¶ RMJREHOME QtO"Risk Manager G Java 1.3 is?$`NljH7F[j5lkG

#l/Hj<rX7^9#

¶ $RMADHOME/bin *hS $RMJREHOME/bin G#l/Hj<, PATH KIC5l^9#

¶ Risk Manager BTD=U!$kO $RMADHOME/bin G#l/Hj<K[V5l^9#

¶ Risk Manager =.U!$kO $RMADHOME/etc G#l/Hj<K[V5l^9#

Windows 79F`GO"$s9H<kfK RMADHOME *hS RMJREHOME D-Qt,

_j5l"79F`D-N PATH KIC5l^9#

�� Risk Manager '��(��

G-N$s9H<k}!Khj"Risk Manager Q"@W?<r$s9H<k9k3H,G-

^9#

AIX ��=5 K"AIX G$s9H<kD=JQC1<8Nj9Hr(7^9#

= 5. AIX G$s9H<kD=J Risk Manager QC1<8

Risk Manager3s]<MsH

QC1<8> U!$k&;CH

>

,WJQC1<8 U)<^CH

(.fmt) ^?O(.cds) U!$k

=N>N=.U!$k

Event Integration

Facility

rmgr.eif rmgr.eif.rte Java130.rte rmad.conf

rmad_summary.rules

Perl Support rmgr.perl rmgr.perl.rte


4.R

iskM

anag

er��

��

= 5. AIX G$s9H<kD=J Risk Manager QC1<8 (3-)

Risk Manager3s]<MsH

QC1<8> U!$k&;CH

>

,WJQC1<8 U)<^CH

(.fmt) ^?O(.cds) U!$k

=N>N=.U!$k

Host IDS

5]<H

rmgr.support rmgr.support.hostids os_aix.fmt1

PIX Firewall N

5]<H

rmgr.support rmgr.support.pix rmgr.eif.rte pix.fmt1

SNMP 5]<H rmgr.support rmgr.support.snmp tecad_snmp.cds2

tecad_snmp.oid

Web Intrusion

Detection System

rmgr.web rmgr.web.rte rmgr.eif.rte

rmgr.web.sig

webids.fmt1 webids.cfg

Web IDS 70K

Ac<

rmgr.web rmgr.web.sig rmgr.web.rte sig.nefarious

Network IDS rmgr.nids rmgr.nids.bff bos.mp"bos.net"

bos.up

nids.fmt

1. Risk Manager EIF *hS TEC Logfile "@W?<GHQ

2. TEC SNMP "@W?<GHQ

'!�� Risk Manager ��

Risk Manager 3s]<MsHr3^sIT+i$s9H<k9k3H,G-^9#

AIX 79F`K Risk Manager "@W?<r$s9H<k9kKO"installp rHQ7^9#

Tivoli Risk Manager CD r CD-ROM Ii$VK^~7F^&sH7^9#?H(P"!N

h&K~O7^9#

mount -v cdrfs -r /dev/cd0 /mnt

AIX QN$s9H<k&$a<8O"/mnt/usr/sys/inst.images K"j^9#

!N3^sIO"3^sIT+i Risk Manager 3^sIr$s9H<k9k}!r(7^

9#3NcGO"installp G -g Ui0rHQ7F0sroHJkU!$kr+0*K$s9

H<k7" -X Ui0KhjU!$k&79F`r+0*K8+7F$^9#!NcN dir

r"4HQN AIX $a<8N"kG#l/Hj<KV-9(F/@5$#

AIX �� Risk Manager Web IDS ��

!N3^sIr~O7^9#

installp -agXd dir rmgr.web

AIX �� Risk Manager SNMP ��

Risk Manager SNMP 5]<HKO"Cisco k<?<*hS ISS RealSecure N5]<H,^^

l^9#

!N3^sIr~O7^9#

installp -agXd dir rmgr.support.snmp

40 P<8gs 3 jj<9 8

AIX �� Risk Manager Cisco Secure PIX Firewall ��

!N3^sIr~O7^9#

installp -agXd dir rmgr.support.pix

AIX �� Risk Manager Host IDS ��

!N3^sIr~O7^9#

installp -agXd dir rmgr.support.hostids

AIX �� Risk Manager Network IDS ��

!N3^sIr~O7^9#

installp -agXd dir rmgr.nids

AIX �� smit ��

smit ^?O smitty rHQ7F Risk Manager 3s]<MsHr$s9H<k9kKO"!N

3HrT$^9#

1. !NH*j~O7^9#

smitty install_latest

2. VINPUT device / directory for software (=UH&'"N~OGP$9 / G#l/Hj<)WU#<kIK"CD GP$9 (c"/dev/cd0) ^?OG#l/Hj<N>0r~O7

^9#

3. VSOFTWARE to install ($s9H<k9k=UH&'")W~OU#<kIr/4=(

7^9#

4. j9H&-< (F4) r!7F"CD eN Risk Manager 3s]<MsHr$s9H<k7^

9#aKe<KO"!Nh&Jj9H,=(5l^9#

rmgr.eif

+ 3.8.0.0 Risk Manager Event Integration Facility

rmgr.perl

+ 3.8.0.0 Risk Manager Perl Support

rmgr.support

+ 3.8.0.0 Risk Manager SNMP Support

+ 3.8.0.0 Risk Manager Support for Cisco Secure PIX Firewall

+ 3.8.0.0 Risk Manager Support for Host IDS

rmgr.web

+ 3.8.0.0 Risk Manager Web IDS Signatures

+ 3.8.0.0 Risk Manager Web Intrusion Detection System

rmgr.nids

+ 3.8.0.0 Network Intrusion Detection System

*r-< (F7) rHQ7F"$s9H<k9k3s]<MsHr*r7^9#

5. Enter r!7F"VLATEST Available Software (G7NHQD==UH&'")WaKe<

+iVInstall and Update ($s9H<k*hS97)WKaj^9#


4.R

iskM

anag

er��

��

6. Enter r!7F"*r7?3s]<MsHr$s9H<k7^9#

7. VARE YOU SURE? (N')WWmsWHGFY Enter r!7F"$s9H<kr31^

9#

Linux ��=6 K"Linux G$s9H<kD=JQC1<8Nj9Hr(7^9#

= 6. Linux G$s9H<kD=J Risk Manager QC1<8

Risk Manager3s]<MsH

QC1<8> ,WJQC1<8 U)<^CH (.fmt)^?O (.cds)U!$k

=N>N=.U!$k

Event Integration

Facility

rmgr-eif-3.8.0-

0.i386.rpm

IBMJava2-JRE-1.3 ¶ rmad.conf

¶ rmad.err

¶ rmad_summary.rules

Perl 5]<H rmgr-perl-3.8.0-

0.i386.rpm

Host IDS 5]<H rmgr-shost-3.8.0-

0.i386.rpm

os_linux.fmt1

PIX Firewall Q"@

W?<

rmgr-spix-3.8.0-

0.i386.rpm

pix.fmt1

CheckPoint FireWall-1

Q"@W?<

rmgr-cpfw-3.8.0-

0.i386.rpm

rmgr-eif cpfw.fmt1 rma_cpfw.conf

Cisco Secure IDS Q

"@W?<

rmgr-csids-3.8.0-

0.i386.rpm

rmgr-eif csids.fmt1

SNMP 5]<H rmgr-ssnmp-3.8.0-

0.i386.rpm

tecad_snmp.cds2

tecad_snmp.oid

Web Intrusion

Detection System

rmgr-web-3.8.0-

0.i386.rpm

rmgr-eif rmgr-perl webids.fmt1 webids.cfg sig.nefarious

Network IDS rmgr-nids-3.8-

0.i386.rpm

nids.fmt



Linux 79F`K Risk Manager "@W?<r$s9H<k9kKO"rpm rHQ7^9#

1. Tivoli Risk Manager CD r CD-ROM Ii$VK^~7^9#

2. CD-ROM Ii$Vr^&sH7^9#

mount -r /dev/cdrom /xmnt

3. !N3^sIr~O7^9#

rpm -i /mnt/cd_drive_name/file_name

file_name O"$s9H<k9kQC1<8N>0G9#

4. Wm0i`NX(K>$"$s9H<kr0;7^9#

Solaris ��43Z<8N=7 K"Solaris QN$s9H<k&QC1<8Nj9Hr(7^9#

42 P<8gs 3 jj<9 8

= 7. Solaris G$s9H<kD=J Risk Manager QC1<8

Risk Manager3s]<MsH

QC1<8> ,WJQC1<8 U)<^CH (.fmt)^?O (.cds)U!$k

=N>N=.U!$k

Event Integration

Facility

RMGReif SUNWj3rt ¶ rmad.conf

¶ rmad.err

¶ rmad_summary.rules

Perl Support RMGRperl

Host IDS 5]<H RMGRshost os_solaris.fmt1

PIX Firewall N

5]<H

RMGRspix RMGReif pix.fmt1

SNMP 5]<H RMGRssnmp tecad_snmp.cds2

tecad_snmp.oid

Web Intrusion

Detection System

RMGRweb RMGReif RMGRperl webids.fmt1 webids.cfg sig.nefarious

CheckPoint FireWall-1

Q"@W?<

RMGRcpfw RMGReif cpfw.fmt1 rma_cpfw.conf

Cisco Secure IDS Q

"@W?<

RMGRcsids RMGReif csids.fmt1

Network IDS RMGRnids nids.fmt



3^sIT+i Risk Manager 3s]<MsHr$s9H<k9kKO"CD Ii$VK CD

r^~7^9#[HsIN Solaris 79F`GO"CD ,+0*K^&sH5l^9#?H(

P"CD Ii$V 0 K CD r^~9kH"CD N$a<8, /cdrom/cdrom0 K^&sH5l

^9#3NcGO"Risk Manager N$s9H<k&$a<8O /cdrom/cdrom0/solaris

G#l/Hj<KV+lF$^9#

!NcN dir r"4HQN Solaris Q$a<8,"kG#l/Hj<KV-9(F/@5$#

Solaris �� Risk Manager Web IDS ��

!N3^sIr~O7^9#

pkgadd -d dir RMGReif RMGRperl RMGRweb

Solaris �� Risk Manager Network IDS ��

!N3^sIr~O7^9#

pkgadd -d dir RMGRnids

Solaris �� Check Point FireWall-1 � Risk Manager ��

!N3^sIr~O7^9#

pkgadd -d dir RMGReif RMGRcpfw

Solaris �� Cisco Secure IDS � Risk Manager ��

!N3^sIr~O7^9#

pkgadd -d dir RMGReif RMGRcsids


4.R

iskM

anag

er��

��

Solaris �� Risk Manager SNMP ��

Risk Manager SNMP 5]<HKO"Cisco k<?<*hS ISS RealSecure N5]<H,^^

l^9#

!N3^sIr~O7^9#

pkgadd -d dir RMGRssnmp

Solaris �� Cisco Secure PIX Firewall � Risk Manager ��

!N3^sIr~O7^9#

pkgadd -d dir RMGReif RMGRspix

Solaris �� Host IDS � Risk Manager ��

!N3^sIr~O7^9#

pkgadd -d dir RMGRshost

Windows ��=8 K"Windows 79F`QN$s9H<k&QC1<8Nj9Hr(7^9#

= 8. Windows 79F`QN Risk Manager QC1<8

Risk Manager $s9H<

kD=*W7gs

,WJ*W7gs U)<^CH (.fmt) ^?O(.cds) U!$k

=N>N=.U!$k

Web Intrusion Detection

System

¶ Risk Manager EIF

¶ Java 1.3 is?$`

¶ Perl 5]<H

¶ Web IDS 70KAc<

webids.fmt1 webids.nt.fmt2 webids.cfg


System 6b70KAc<

sig.nefarious

Cisco Secure IDS Q

"@W?<¶ Risk Manager EIF

¶ Java 1.3 is?$`

csids.fmt1 csids.nt.fmt2

CheckPoint FireWall-1 Q

"@W?<¶ Risk Manager EIF

¶ Java 1.3 is?$`

cpfw.fmt1 cpfw.nt.fmt2 rma_cpfw.conf

Risk Manager EIF; s TME

$s?<U'<9

Java 1.3 is?$` ¶ rmad.conf

¶ rmad.err

¶ rmad.summary.rules

Risk Manager EIF; TME

$s?<U'<9

Java 1.3 is?$` ¶ rmad.conf

¶ rmad.err

¶ rmad.summary.rules

Event Log *hS SNMP

5]<H; Host IDS 5]<

H

os_nt.fmt2

Event Log *hS SNMP

5]<H; PIX Firewall

5]<H

pix_nt.fmt2

Event Log *hS SNMP

5]<H; Norton Anti-Virus

5]<H

rmnav.fmt2

44 P<8gs 3 jj<9 8

= 8. Windows 79F`QN Risk Manager QC1<8 (3-)

Risk Manager $s9H<

kD=*W7gs

,WJ*W7gs U)<^CH (.fmt) ^?O(.cds) U!$k

=N>N=.U!$k

Event Log *hS SNMP

5]<H; McAfee Alert

Manager

rmmac.fmt2

Event Log *hS SNMP

5]<H; SNMP 5]<H

tecad_snmp.cds3

tecad_snmp.oid

Java 1.3 is?$`

1. Risk Manager EIF GHQ

2. Windows Event Log "@W?<GHQ


Windows 79F`GN Risk Manager "@W?<N$s9H<kKO"InstallShield rHQ

7^9#


2. $s9H<k&QC1<8N"kG#l/Hj<K\07^9#

cd x:¥windows

x: O4HQN CD-ROM Ii$VG9#

3. Windows InstallShield Wm0i`r/09kKO"!NH*j~O7^9#

setup

4. InstallShield Wm0i`NX(K>CF"$s9H<kr0;7^9#

��3N;/7gsGO"!N5<P<X"N$s9H<kjgKD$Fb@7^9#

¶ 8`N Tivoli "@W?< (TME "@W?<HFPlk) N$s9H<k

¶ Tivoli Entprise Console (TEC) U)<^CH&U!$k*hS/i9jA9F<HasH

(.cds) U!$kN$s9H<k

¶ $YsH&5<P<&U!$kN$s9H<k

TME ��

Tivoli Management Enterprise (TME) "@W?<O"psr}87"m<+k&U#k?<`

nrBT7":v9k$YsHr TEC KhCFHQG-kU)<^CHKQ99k=UH&

'"&Wm0i`G9#TME "@W?<H7FO"Tivoli Logfile "@W?< (UNIX *Zl

<F#s0&79F`Q)"Windows Event Log "@W?<"^?O SNMP "@W?<,D

=G9#TME "@W?<O",ZJU)<^CH&U!$krHQ9k3HKhCF"TEC

$YsHr8.7^9#

TME "@W?<O"(sI]$sH^?Os Tivoli 79F`G$s9H<k5l^9#TME

(sI]$sH&"@W?<O""@W?<=.!=HloKQC1<85lF$^9#

TME "@W?<O"=liN$YsHr TEC 2<H&'$Kw.7^9#TEC 2<H&'

$O"=liN$YsHrPsIk7"$YsH&5<P<K>w7^9#L.KO TME $


4.R

iskM

anag

er��

��

s?<U'<9,HQ5l^9#TEC 2<H&'$O"GU)kHKhCF"5<P<XN

\3X~5<S9rHQ7^9#\3X~5<S9HO""@W?<,i|=5lkH-K\

3,N)5l"$YsHNw.QK\3,]}5lk3HrU#7^9#TEC 2<H&'$

Khj""@W?<NhjFWJ8+H"Tivoli ACF N"@W?<=.WmU!$k (ACP)

Khk"@W?<N97,D=KJj^9#

TME "@W?<O"=liN$YsHrCjN 1 !^?O 2 !$YsH&5<P<Kw.

9kh&K=.5l^9#TEC O",9"$YsHr>w7^9#TEC 2<H&'$O"(

sI]$sH&2<H&'$&5<S9rs!7F$kNH18I}P]N<IGT/7^

9#TEC 2<H&'$H"F(sI]$sH&WiCHU)<`QN,WJ"@W?<&U

!$kO"I}P]N<IK$s9H<k5l^9#"@W?<H"@W?<X"U!$kr

(sI]$sHK[[G-kh&K9k?aK"ACF O"(sI]$sH&2<H&'$H

18I}P]N<IK$s9H<k9k,W,"j^9#7?,CF"Tivoli I}j<8gs

(TMR) bG(sI]$sH&2<H&'$H7F=.5lk9YFNI}P]N<IK ACF

r$s9H<k9k3H,EWG9#

\qGO"TME "@W?<N$s9H<k*hS=.KD$FO7$^;s#Risk Manager

GHQ9k!N"@W?<r$s9H<k9k}!KD$FO"VTivoli Enterprise Console

"@W?<&,$IWr2H7F/@5$#

¶ Tivoli Logfile "@W?< (UNIX syslogd)

¶ Tivoli Windows Event Log "@W?<

¶ SNMP "@W?<

TME "@W?<r$s9H<k7?e"U)<^CH*hS/i9jA9F<HasH&U

!$kr$s9H<k7J1lPJj^;s#jgKD$FO"VTivoli Enterprise Console

f<6<:&,$IWr2H7F/@5$#

��)��

Risk Manager U)<^CH*hS=.U!$kO"Tivoli Risk Manager 5<P< 3.8 H$&iYk,U$?$s9H<k&QC1<8G"Risk Manager =JHloKs!5l^9#

TEC $YsH&5<P<eG Risk Manager Server r$s9H<k9kKO"Tivoli G9/

HCWKhk$s9H<k}!,D=G9#

��$YsH&5<P<*hSjX3s]<MsHN$s9H<kr0;7?e"J<N?9/r

TCF"$YsH&5<P<,$YsHru1~l"jX5;"=(9kh&K=.7F/@

5$#

¶ J<N3HrTCF"Tivoli $YsH&5<P<, Risk Manager $YsHru1~l"

jX5;"=(9kh&K=.7^9#

v 77$k<k&Y<9rn.9k+"^?O{8Nk<k&Y<9r979k#

v Risk Manager BAROC U!$krk<k&Y<9K$s]<H9k#

v Risk Manager k<k&U!$krk<k&Y<9K$s]<H9k#

v k<k&Y<9r3sQ$k9k#

46 P<8gs 3 jj<9 8

v Prolog =.U!$kr3sQ$k9k#

v 3sQ$kQ_Nk<k&Y<9rm<I9k#

v Tivoli $YsH&5<P<rd_7"FO09k#

Risk Manager GO"3liN?9/rT&?aN TEC Correlation rmcorr_cfg =.Wm

0i`,QU5lF$^9#\7/O"64Z<8NXRisk Manager Server Correlation 9

/jWHNBTYr2H7F/@5$#

¶ Risk Manager U)<^CH&U!$krUC9k3HKhCF"TME "@W?<QNU

)<^CH&U!$kr977^9#\7/O"XRisk Manager H TME "@W?<NU

)<^CH&U!$kNkgYr2H7F/@5$#

Risk Manager � TME �� !+��)��TME "@W?<r$s9H<k""s$s9H<k"*hSGPC09k}!KD$FO"

VTivoli Enterprise Console "@W?<&,$IWr2H7F/@5$#

"@W?<=.!= (ACF) rHQ7F"977?U)<^CH&U!$kr TME "@W?

<K8+9k=jG"klgO"/i$"sHNU)<^CH&U!$kH Risk Manager U

)<^CH&U!$kr">}NU)<^CH&U!$kK&L9kljK3T<7^9#

ACF rHQ7F[[9k0K"2 DNU)<^CH&U!$kr^<87F/@5$#

J<NjgrHQ9k3HKhj"/i$"sHG",WJ Risk Manager U)<^CH&U

!$kr TME "@W?<NU)<^CH&U!$kHj0Gkg9k3H,G-^9#

TEC H Risk Manager NU)<^CH&U!$krj0Gkg9kKO"!Nh&K7^

9#

1. $YsH&5<P<+i"TME "@W?<r$s9H<k7?(sI]$sHKU)<^

CH&U!$kr>w7^9#Risk Manager U)<^CH&U!$kQNl~G#l/H

j< (?H(P"¥tmp¥fmt) rn.7"$YsH&5<P<+i3NG#l/Hj<KU)

<^CH&U!$kr>w7^9#

2. !Nh&K~O7F"l~G#l/Hj<bN Risk Manager U)<^CH&U!$kr

TME "@W?<N etc G#l/Hj<K3T<7^9#

Windows 79F`:

copy ¥tmp¥fmt¥*.fmt TecAdHome¥etc

TecAdHome O"TME "@W?<NGU)kHN$s9H<kljG9#

C:¥Program Files¥Tivoli¥lcf¥bin¥w32-ix86¥TME¥TEC¥adapters¥etc

UNIX 79F`:

cp /tmp/fmt/*.fmt TecAdHome/

TecAdHome O"TME "@W?<NGU)kHN$s9H<kljG9#

(sI]$sH, Solaris 79F`Nlg"GU)kHN$s9H<kLVO!NH*j

G9#

/opt/Tivoli/lcf/bin/solaris2/TME/TEC/adapters/


4.R

iskM

anag

er��

��

(sI]$sH, AIX 79F`Nlg"GU)kHN$s9H<kLVO!NH*jG

9#

/opt/Tivoli/lcf/bin/aixr4-r1/TME/TEC/adapters/

3. !Nh&K~O7F""@W?<N etc G#l/Hj<K\07^9#

Windows 79F`:

cd TecAdHome¥etc

UNIX 79F`:

cd TecAdHome/etc

4. !Nh&K~O7F"5NU)<^CH&U!$kNPC/"CW&3T<rn.7^

9#

Windows 79F`:

copy tecad_nt.fmt tecad_nt.fmt.bak

UNIX 79F`:

cp tecad_logfile.fmt tecad_logfile.fmt.bak

5. *j8JkNU)<^CH&U!$kK",WJ Risk Manager U)<^CH&U!$k

(Windows QN tecad_nt.fmt ^?O tcad.win.fmt""k$O UNIX QN

tecad_logfile.fmt) r"k7^9#

Host Intrusion Detection QN Risk Manager "@W?<rHQ9klg (os_nt.fmt"

os_aix.fmt"^?O os_solaris.fmt)"tecad_nt.fmt"tcad.win.fmt"^?O

tecad_logfile.fmt U!$kN*j8JkNbFrV-9(^9#

U)<^CH&U!$kN"k

Windows NT U)<^CH&U!$k

cat tecad_nt.fmt.bak > tecad_nt.fmt

cat webids.nt.fmt >> tecad_nt.fmt

cat pix_nt.fmt >> tecad_nt.fmt

AIX U)<^CH&U!$k

cat tecad_logfile.fmt.bak >tecad_logfile.fmt

cat webids.fmt >>tecad_logfile.fmt

cat csids.fmt >>tecad_logfile.fmt

cat rmnav.fmt >>tecad_logfile.fmt

cat pix.fmt >>tecad_logfile.fmt

Solaris U)<^CH&U!$k

cat tecad_logfile.fmt.bak >tecad_logfile.fmt

cat webids.fmt >>tecad_logfile.fmt

cat csids.fmt >>tecad_logfile.fmt

cat rmnav.fmt >>tecad_logfile.fmt

cat pix.fmt >>tecad_logfile.fmt

48 P<8gs 3 jj<9 8

6. .cds U!$krF8.7^9#gencds Wm0i`KD$FNGU)kHNljO"!N

H*jG9#

Windows 79F`:

..¥TME¥TEC¥adapters¥bin¥nt_gencds tecad_nt.fmt tecad_nt.cds

UNIX 79F`:

../opt/Tivoli/lcf/dat/1/cache/Solaris2/TME/TEC/adapters/bin/

7. Windows 79F`NV3sHm<k QMkWrHQ9k+"^?O!Nh&K~O9k

3HKhCF"TME "@W?<rd_7"FO07^9#

Windows 79F`:

%LCFROOT%¥..¥tec¥adapters¥bin¥net stop TECNTadapter%LCFROOT%¥..¥tec¥adapters¥bin¥net start TECNTadapter

UNIX 79F`:

../bin/init.tecad_logfile stop

../bin/init.tecad_logfile start

ACF �� Risk Manager ��ACF rHQ7F"Tivoli D-N(sI]$sHeG"U)<^CH&U!$k"=.U!$

k".cds"*hS70KAc<&U!$kr=.9k3H,G-^9#

ACF r(sI]$sH&2<H&'$H18I}P]N<IeK$s9H<k7F"Risk

Manager "@W?<*hS"@W?<X"U!$kr(sI]$sHK[[9k3H,G-^

9#TMR 4NG(sI]$sH&2<H&'$H7F=.5l?9YFNI}P]N<Ie

K ACF r$s9H<k9k3H,EWG9#^?"ACF r TMR 5<P<=NbNKb$

s9H<k7^9#ACF Khk$s9H<kKD$FO"VTivoli Enterprise Console f<6

<:&,$IWKb@,"j^9,"ACF rHQ7? Risk Manager 3s]<MsHN=.

9FCWN5,rJ<K(7^9#

1. f{]$sH+i$s9H<k9kKO"Risk Manager CD +i$s9H<k&$a<8

,$s]<H5lF$k3HrN'7F/@5$#

2. ,:"Tivoli G9/HCWeK",ZJvDNrd!=r}D"I_K9Hl<?<H7

Fm0*s7F/@5$#

3. "I_K9Hl<?<N TME G9/HCWG"VTEC-Region (TEC Nh)W"$3sr@Vk/jC/7^9#

4. VProfiles for Enterprise Risk Management (Enterprise Risk Management NWmU!$k)WWmU!$k&"$3sr@Vk/jC/7F"VProfile Manager (WmU!$

k&^M<8c<)W&#sI&r=(7^9#

5. WmU!$k&"$3sr@Vk/jC/7F"WmU!$krT87^9#,WK~8

FQ9rC(?e"VSave & Close (]I & /m<:)Wr/jC/7F"VAdapter

Configuration Profile ("@W?<=.WmU!$k)W&#sI&Kaj^9#

6. [[9kWmU!$kr*r7^9#

7. VDistribute Profiles (WmU!$kN[[)W&#sI&,=(5l^9#

8. VProfile Manager (WmU!$k&^M<8c<)Wr/jC/7F"VDistribute ([[)Wr/jC/7^9#


4.R

iskM

anag

er��

��

9. [[}!H5V9/i$P<KX9kpsr0.5;F"VDistribute Now ((~[[)Wr/jC/7^9#

ACF ��&��ACF rHQ7F"!N Risk Manager "@W?<^?;s5<r=.7^9#

¶ Host IDS Q Risk Manager "@W?<

¶ Norton AntiVirus Q Risk Manager "@W?<

¶ Cisco Secure PIX Firewall Q Risk Manager "@W?<

¶ Check Point FireWall-1 Q Risk Manager "@W?<

¶ Internet Security Systems RealSecure (ISS RealSecure) Q Risk Manager "@W?<

¶ Cisco k<?<Q Risk Manager "@W?<

¶ Cisco Secure IDS Q Risk Manager "@W?<

¶ McAfee Alert Manager Q Risk Manager "@W?<

¶ Risk Manager Web IDS ;s5<

¶ Risk Manager Network IDS ;s5<

ACF �1�)��(sI]$sHK Risk Manager "@W?<r$s9H<k9kH"Lo"Risk Manager

ACF WmU!$krHQ7FICN=.rT&3H,G-^9#3liN ACF WmU!$

k,n09k?aKO"(sI]$sHeK TME "@W?<r"i+8a$s9H<k7F

*+J1lPJj^;s#

J<N Risk Manager WmU!$krHQ9k3HKhj"$s9H<keN=.rYg7?

j"Risk Manager "@W?<r+0*K+O9k3H,G-^9#

¶ Web IDS Q"@W?<

3N Risk Manager WmU!$krHQ7F"Web IDS =.U!$k (sig.nefarious *

hS webids.cfg) r977^9#

¶ Web IDS Q Event Integration Facility "@W?<

3N Risk Manager WmU!$krHQ7F"Risk Manager Event Integration Facility r

977^9#=N]"Web IDS U)<^CH&U!$k (webids.fmt) rHQ7^9#

¶ Check Point FireWall-1 Q"@W?<

3N Risk Manager WmU!$krHQ7F""@W?<N=.U!$k

(rma_cpfw.conf) r977^9#

¶ Risk Manager Event Integration Facility Q=.U!$k

3N Risk Manager WmU!$krHQ7F"Risk Manager Risk Manager Event

Integration Facility =.U!$k (rmad.conf) r977^9#

¶ Risk Manager Event Integration Facility QU)<^CH&U!$k

3N Risk Manager WmU!$krHQ7F"Risk Manager Risk Manager Event

Integration Facility U)<^CH&U!$k (rmad.fmt) r977^9#

¶ Host IDS N?9/&5]<H

3N Risk Manager WmU!$krHQ7F"rmt_ntaudit.exe BTD=U!$kr

Windows NT (sI]$sHK[[7^9#

50 P<8gs 3 jj<9 8

m: Windows NT (sI]$sHrVis/r^`G#l/Hj<<K$s9H<k7J

$G/@5$#

?H(P"Program Files G9#

¶ Network IDS Q"@W?<

3N Risk Manager WmU!$krHQ7F"Network Intrusion Detection System =.U

!$k (ids.cfg *hS ids.rules) r977^9#

TME "@W?<N=.rYg9k?a"!NWmU!$k,QU5lF$^9#

¶ Web IDS Q Logfile

¶ Host IDS Q Logfile

¶ Cisco Secure PIX Firewall Q Logfile "@W?<

¶ Cisco Secure IDS Q Logfile "@W?<

¶ Symantec Norton AntiVirus Q$YsH&m0&"@W?<

¶ Cisco k<?<Q SNMP "@W?<

¶ ISS RealSecure Q SNMP "@W?<

¶ Network IDS Q Logfile

��Risk Manager $YsH&0k<Wrn.7J1lPJj^;s#$YsH&0k<Wrn.

9k3HKC(F"3liN$YsH&0k<WQNU#k?<rjA7J1lPJj^;

s#Risk Manager GO"d)5lk$YsH&0k<WHU#k?<r^`"(/9]<H

Q_N$YsH&0k<WjAU!$k,s!5l^9#0k<Wrn.7"U#k?<rj

A9k}!KD$FO"52Z<8NX$YsH&0k<WNn.Yr2H7F/@5$#

!K"Risk Manager G-N$YsH&0k<Wr"I_K9Hl<?<KdjvF^9#"

I_K9Hl<7gsNrdN\YKD$FO"VTivoli Enterprise Console f<6<:&,

$IWr2H7F/@5$#

!N=GO"d)5lk Risk Manager $YsH&0k<WKD$FNpsrWs7^9#

$YsH&3sFJ<> jAQ_NU#k?< $YsH&0k<W

RM_Reception RM_SensorEvent 9YFN Risk Manager $YsH#

RM_SensorEvent +i5V/i9=5lk9Y

FN$YsHr^_^9#

RM_Situations RM_Situation jXWm;9KhCF!P5lkT3Jh0#/

i9 RM_Situation1"RM_Situation2"*hS

RM_Situation3 N9YFN$YsHr^_^9#

RM_TrustedHosts RM_TrustedHost /i9 RM_TrustedHost N9YFN$YsHr^_^9#

RM_Exceptions RM_Error !Nh&J"9YFNbt(i<r^_^9#

¶ RM_InputErr¶ RM_SituationErr¶ RM_PrologErr

RM_Sensors RM_Sensor ;s5<&$s9?s9#


4.R

iskM

anag

er��

��

i|$s9H<k*hS=.Ne"$YsH&0k<WrQ97?j"H+N$YsH&0k

<Wrn.7F"U#k?<rjA7?j9k3H,G-^9#\7/O"X$YsH&0k

<WNn.Yr2H7F/@5$#

��$s9H<k*hSi|=.Ne"J<NjgK>CF"TEC QN Risk Manager $Ys

H&0k<WH"X"9kU#k?<rn.7F/@5$#

1. Tivoli Enterprise Console r+O7^9#

2. 8^&9&\?sr/jC/7"VFile (U!$k)WaKe<r*r7"VImport ($s]<H)Wr*r7^9#

3. VBrowse (2H)W\?sr/jC/7F" TEC 5<P<eN!NljK"k

riskmgr_eventgroups.dat U!$kr*r7^9#

Windows 79F`:

%BINDIR%¥RISKMGR¥corr

UNIX 79F`:

$BINDIR¥RISKMGR¥corr

BINDIR O"$YsH&5<P<&P$Jj<,8_9kG#l/Hj<G9#

4. VEvent Groups ($YsH&0k<W)W&#sI&K=(5lk$YsH&0k<Wr

*r7^9#

RM Events (RM $YsH)

RM Situations (RM uV)

RM Sensors (RM ;s5<)

RM Trusted (RM Hi9FCI)

RM Exceptions (RM c0)

5. %g9HiF8<KX9k,WJ*W7gsr*r7"VOKWr/jC/7^9#

VChange Names (>0NQ9)W*W7gsr*r9kH"0k<W,9GK8_9kl

gK>0,Q95lk?a"GbB4G9#

6. VNotice (LN)WQMkGVOKWr/jC/7"3s=<krFO07^9#

7. $YsH&0k<W*hS*Zl<?<r,ZJ3s=<kKdjvF^9#

Web �� Risk Manager ��Risk Manager 3.8 KO"Risk Manager uV$YsHQN Web Y<9Nps,^^lF$^

9# Risk Manager uVKX"7?D9N Risk Manager $YsHKX9kICpsr=(9

k3H,G-^9#3NpsO"TEC +ixQ9k3H,G-^9#

Web ��-#��3N;/7gsGO"$YsHKX9k Web Y<9Npsr=(9k0KG<?Y<9&S

e<N_jrT&}!KD$Fb@7^9#VTivoli Decision Support for Enterprise Risk

Management jj<9&N<HWNb@K>$G<?&^$Ks0QKD-,_j5lF$k

lgO"3NSe<,n.5lF$kNG"J<N9FCWrT&,WO"j^;s#

52 P<8gs 3 jj<9 8

m: G<?Y<9>"f<6< ID"*hSQ9o<IO"WiCHU)<`*hSD-KG

-NbNG9#\YKD$FO"79F`&"I_K9Hl<?<K*d$go;/@5

$#

1. Risk Manager 5<P<N $BINDIR/RISKMGR/corr/sql G#l/Hj<N SQL Wm7<8

c<&U!$kr57^9#

2. J<Nj9HK"k"$s9H<k5lF$kG<?Y<9QN3^sIrHQ7^9#

TEC G<?Y<9,$s9H<k5lF$k79F`G3^sIrBT7^9#

Oracle 79F`:

sqlplus userid/password@service_name@tds_rm_tec_v_evt.ora.sql

F`\O"!NH*jG9#

userid G<?Y<9&f<6< ID r=7^9#GU)kHMO tec G9#

password

G<?Y<9Nf<6<&Q9o<Ir=7^9#GU)kHMO tectec G9#

service_name

Oracle /i$"sH=.Wm0i`GjA5l? Oracle G<?Y<9NMCH&

5<S9> (″Net8 Assistant″"″Net8 Configuration Assistant″"^?O ″Net8 Easy

Configuration″)""k$O/i$"sHN

%ORACLE_HOME%¥NETWORK¥ADMIN¥TNSNAMES.ORA U!$kNF`\r1L9k>0r

=7^9#

DB2 79F`:

db2 connect to tec user userid using passworddb2 -t -f tds_rm_tec_v_evt.DB2.sql

F`\O"!NH*jG9#

userid G<?Y<9&f<6< ID r=7^9#UNIX® NlgNGU)kHMO"

db2inst1 G9# Windows NT® NGU)kHMO"db2admin G9#

password

G<?Y<9Nf<6<&Q9o<Ir=7^9#

Sybase 79F`:

isql -U userid -P password -Dtec -Sservername -c/ -i tds_rm_v_evt.syb.sql

F`\O"!NH*jG9#


password


server DSEDIT /i$"sH=.Wm0i`GjA5l? Sybase G<?Y<9N5<P

<>"^?O/i$"sHN Sybase $s?<U'<9&U!$k

%SYBASE%¥INI¥SQL.INI NF`\r1L9k>0r=7^9#


4.R

iskM

anag

er��

��

Web �� TEC ��Risk Manager N Web Y<9psr_j9kKO"TEC _jrT&,W,"j^9#!Nh

&K7^9#

1. VTEC Configuration (TEC =.)W&#sI&G"VConsoles (3s=<k)Wr*r7^

9#

2. &/jC/7F"VConsole Preferences (3s=<k_j)Wr*r7^9#

3. VWeb Server (Web 5<P<)Wr*r7F+F4j<rH%7"VEvent Information($YsHps)Wr=(7^9#

4. VEvent Information ($YsHps)Wr*r7^9#

5. Wm0i`&Q9&U#<kIrT87"/cgi-bin/rmtec_help.pl H7^9#

6. VOKWr/jC/7^9#

m:

DB2® QNGU)kHN9F<HasH&R<W&5$:O"G<?Y<9&Se<+i

N$YsHNjP~KBT5lk#(J SQL 9F<HasHr5]<H9kKOT=,

G9#Web Y<9ps!=rHQ7F"D9N$YsH\YK"/;99k]"(i

<&aC;<8 SQL0101N ��,=(5lklg,

"j^9#3N(i<rrh9kKO"9F<HasHNR<W&5$:r 8000 JeK

Q97^9#

R<W&5$:r979kKO"IBM DB2 3^sI&WmsWHr+-"!Nh&K~

O7^9#

> db2 update db cfg for tec using stmtheap 8000

9F<HasHNR<W&5$:r977?e"Q9,?G5lkh&"IBM DB2 +i

9YFN"Wj1<7gsrZG7^9#Q9,?G5lkH"YpaC;<8

SQL0437W ��

,=(5lklg,"j^9#3lOYpJNG"5k7F=$^;s#

IBM DB2 N=."QU)<^s9*hS40KD$FO"VIBM® DB2 UDB I}Nj

z-"1 A 3 ,W*hSVIBM DB2 UDB 3^sIrbWr2H7F/@5$#

Risk Manager '��(��Tivoli wuninst 3^sIrHQ7F"Risk Manager $YsH&5<P<*hS Perl Support

3s]<MsHrI}P]N<I+i|n7^9#"@W?<r|n9kKO"G-N3^s

IrHQ7F/@5$#

��.��Risk Manager $YsH&5<P<*hS Perl Support 3s]<MsHO"I}P]N<Ie

K$s9H<k5l^9#Tivoli wuninst 3^sIrHQ7F"U!$kr|n7^9#

!NH*j~O7^9#

wuninst tag node_name -rmfiles

54 P<8gs 3 jj<9 8

tag O"RISKMGR_CORR ^?O RISKMGR_PERL N$:l+" node_name O"=Jr|n9kI

}P]N<IG9#

��=9 NjgK>$"Risk Manager "@W?<r"s$s9H<k7^9#

= 9. Risk Manager "@W?<r"s$s9H<k9k?aNG-N3^sI

WiCHU)<` "s$s9H<k&3^sI

AIX installp -u package_name

Linux rpm -e package_name

Solaris pkgrm package_name

Windows 79F` install -u package_name


4.R

iskM

anag

er��

��

56 P<8gs 3 jj<9 8

Risk Manager Server Correlation

$s9H<k7?=l>lN;s5<O"1lNj=<9 ([9Hdk<?<JI) ^?Oj

=<9NMCHo</rbK?<7^9#=l>lN;s5<GO"$YsH ("i<HHb

FPlk) NAGps,8.5l^9#3liN$YsHO";s5<KhCF!P5l?T

3Jh0^?O;-ejF#<X"Ndjr=7^9#

jXO"$YsHrfS7F"l"Nk<krbHK0n7^9#Risk Manager KU0NG

U)kH&k<krHQ9k3HbG-lP"k<krQ99k3HbG-^9#3NOG

O"3liNk<kKpE$F Risk Manager N0nrjA9k?9/KD$Fb@7^9#

[HsIN?9/GO""I_K9Hl<?<,=.U!$krT87"=.U!$krh}

9k9/jWHrBT9k,W,"j^9#

Risk Manager NjXWm;9GO"e.7?9YFN Risk Manager $YsH,,O5l"

Q?<s,!w5l^9#Q?<sN!wNkLH7F!P5l?T3Jh0^?OdjO"

uV HFPl^9#uVO"Tivoli Event Console (TEC) G TEC $YsHH7F=(5l^

9#

jXWm;9O"#tN;s5<+iN/~!Npsr7)K4:7"X8N"kpsrJi

JU)<^CHG=(9k?a"i9YH*Zl<?<NaiYro:9kNKr)A^9#

jXK*$F/89k"^?O=.U!$kNT8fK/89k(i<KD$FO"227Z<

8NXRisk Manager NjXaC;<8YGb@7^9#

��Q?<sN!wNkLH7F!P5l?T3Jh0^?OdjO"uV HFPl^9#3l

iNuVO"!N-<KpE$F=L5l^9#

¶ $YsHN+F4j<

¶ T3Jh0N8h[9H -- "/;95lF$kj=<9

¶ T3Jh0N=<9&[9H -- h0N/85

Risk Manager Server Correlation GO"uVr>A9k?aKICps (6bN|~d"Eg

YJI) ,HQ5l^9#?@7"3liNpsO"uVNjAKOHQ5l^;s#e.7

?$YsHNEgYM,"riskmgr_thresholds.pro =.U!$kGjA5l?7-$Mr6

(kH" Risk Manager Server Correlation KhCFuV$YsHNn.,/0 5l^9#

RM_Situation /i9O"uV$YsHNp\/i9G9#uV$YsHO"8s*hSjX

Wm;9NkLG9#8s*hSjXWm;9NkL"{8NuV$YsHNQ9,/3k3

Hb"j^9#uVKO"!N 3 DNFQ?$W,"j^9 (FQ-Nc$bN+igKj

5


5.R

iskM

anag

erS

erverC

orrelatio

n

9H7^9)#

RM_Situation1 $YsH 3 DN-<,9YFXj5lk#

RM_Situation2 $YsH 2 DN-<,Xj5lk#

RM_Situation3 $YsH 1 DN-<,Xj5lk#

Risk Manager Server Correlation GO"!NuV?$W,jA5lF$^9#

= 10. Risk Manager Server Correlation KhjjA5lkuV

uV?$W -< 1 -< 2 -< 2 b@

1 +F4j< 8h =<9 1 DN=<9&[9H+i 1 DN8h

[9HKP7FTol?"Xj5l?+

F4j<NCjNh0r=7^9#

2-1 Destination/Source 8h =<9 +F4j<Nj

9H

"k[9H+iLN[9HKP7FTo

l?"-OONT3Jh0r=7^9#

2-2

Category/Destination

+F4j< 8h =<9Nj9H #tN=<9+i 1 DN[9HKP7

FTol?"Xj5l?+F4j<NT

3Jh0NQ?<sr=7^9#

2-3 Category/Source +F4j< =<9 8hNj9H 1 DN=<9+i#tN8hKP7FT

ol?"Xj5l?+F4j<NT3J

h0NQ?<sr=7^9#

3-1 Source =<9 +F4j<Nj9H 8hNj9H 1 DN=<9+iTol?"-OOKo

?kh0NQ?<sr=7^9#

3-2 Destination 8h +F4j<Nj9H =<9Nj9H #tN=<9+i 1 DN8h[9HK

P7FTol?"-OOKo?kh0N

Q?<sr=7^9#3N7Jj*O"

4/lL*KO"0tG-OOKHQ5

lk5<P< (Web 5<P<JI) KP

9kbNG9#

3-3 Category +F4j< 8hNj9H =<9Nj9H #tN=<9H#tN8hr}DCjN

?$W (1 DN+F4j<b) NT3J

h0NQ?<sr=7^9#3N7Jj

*OaC?K"j^;s,"6bKP9

k7?Je@,-/Nikh&KJC?

H-K/3kD=-,"j^9#

vBe"uVNFQ-,b$[I"hjqN*JuV+iNps,^^l^9#D^j"uV

2 O":v9k9YFNuV 1 U!/H+iNG<?N_QG"j"uV 3 O":v9k9

YFNuV 2 U!/H+iNG<?N_QG9#FQ-Nb$uVU!/HKO"hjqN

*JuVU!/HKhCF=5lk9YFNps,^^lkHOBj^;s#FQ-Nb$u

VNEgYlYkO"hjqN*JuVN_Q7?EgYlYkr?G7^9#

F$YsHNpsO"l"NTK=(5l^9#FTKO"GgG 256 P$HN-?*hS

=(,D=G9#TNps,?9.klgOZjNFil^9#

Hj,<NroO"9YFNuVG18G9#uVO"EgYMH7-$Mr}A^9#Eg

YMO">0NM"GeN97+iNPa~V"*hS77$$YsHNEgYM+i"t0

rHQ7FW;5l^9#EgYM,7-$Mr6(kH"Risk Manager KhCFuV$Y

sH,n.5l^9#

58 P<8gs 3 jj<9 8

Risk Manager Correlation '��(�3liN Risk Manager Correlation *hS Tivoli $YsH&5<P<&3s]<MsHN[

[KO"Tivoli Risk Manager 5<P< 3.8 QC1<8rHQ7^9#

¶ Risk Manager .baroc U!$k

¶ Risk Manager .pro U!$k

¶ Risk Manager .rls U!$k

¶ Risk Manager .fmt U!$k

¶ Risk Manager .cds *hS .oid U!$k

¶ Risk Manager =.U!$k

Tivoli G9/HCWrHQ7F"Tivoli Risk Manager 3.8 $s9H<k&QC1<8N

Risk Manager TEC Correlation *hS Risk Manager X"N5<P<&3s]<MsHr

Tivoli D-NI}P]N<IK$s9H<k7^9#

Risk Manager Correlation N$s9H<k,0;7?e"Risk Manager Correlation N=.rT

$^9#

Risk Manager Correlation ��$YsH&5<P<*hSjX3s]<MsHr$s9H<k7?e"J<N?9/rTC

F"$YsH&5<P<,$YsHru1~l"jX5;"=(9kh&K=.7F/@5

$#

1. ,WK~8F"Correlation =.U!$kN_jrT87^9#\7/O"X=._jNQ

9Yr2H7F/@5$#

2. TEC Correlation N rmcorr_cfg =.9/jWH&U!$krBT7F"Risk Manager k

<kN3sQ$kHH_)F"Tasks for Enterprise Risk Management ?9/&i$Vij

<N3sQ$kH$s9H<k"*hS Profiles for Enterprise Risk Management N$s9

H<krT$^9#\7/O"64Z<8NXRisk Manager Server Correlation 9/jWHN

BTYr2H7F/@5$#

3. Risk Manager G-N$YsH&0k<Wr"I_K9Hl<?<KdjvF^9#"I_

K9Hl<7gsNrdN\YKD$FO"VTivoli Enterprise Console f<6<:&,$

IWr2H7F/@5$#

4. Risk Manager H Tivoli Management Enterprise (TME) "@W?<&U)<^CH&U!$

krkg7^9#\7/O"47Z<8NXRisk Manager H TME "@W?<NU)<^C

H&U!$kNkgYr2H7F/@5$#

��=._jrQ99kKO"J<N=.U!$krT87^9#

=.U!$kO"!NLVK"j^9#

Windows 79F`:

%BINDIR%¥RISKMGR¥corr¥tec


5.R

iskM

anag

erS

erverC

orrelatio

n

UNIX 79F`:

$BINDIR/RISKMGR/corr/tec


62Z<8NXRisk Manager Server Correlation N=.YK"=.U!$kKP7FT&3HN

G-kQ9Nj9HH"=l>lNQ9}!r(7^9#

=.U!$krT87?e"rmcorr_cfg 9/jWHrBT7FQ9rT$^9#

Risk Manager ��Risk Manager =.9/jWH&U!$k rmcorr_cfg O"Tivoli $YsH&5<P<, Risk

Manager $YsHru.7"jX5;"=(9kh&K=.7^9#

rmcorr_cfg =.7'k&Wm0i`KO"!N*W7gs,"j^9#

-delete =TN TEC $YsH&5<P<+i Risk Manager 3s]<MsHr|n7

^9 (3lKO"=TNk<k&Y<9*hSk<k&Y<9&G#l/Hj

<No|,^^l^9)#GU)kHN TEC k<k&Y<9,Fm<I5l

^9#

-dir k<k&Y<9N$s9H<khNG#l/Hj<rXj7^9#

-exist Risk Manager N$s9H<k~KHQ5lk{8Nk<k&Y<9rXj7

^9#

-install k<k&Y<9r$s9H<k7^9#

-new Risk Manager N$s9H<k~KHQ5lk7,Nk<k&Y<9rXj7

^9#

-reconfig Q97?=.U!$kr977"$YsH&5<P<rFO07^9#

riskmgr_ GO^k .pro =.U!$krQ97?lgK"3N*W7gsr

HQ7J1lPJj^;s#

-status Risk Manager 3s]<MsHNu7r=(7^9#

-tasklib Risk Manager ?9/&i$Vij<r3sQ$k7FGU)kHN8gVr

n.7^9#

-uninstall =TN TEC $YsH&5<P<+i Risk Manager 3s]<MsHr|n7

^9 (?@7"=TNk<k&Y<9Oo|7^;s)#

-update =TNk<k&Y<9r977^9# BAROC U!$krQ9^?OIC7

?eKHQ7F/@5$#

3liF*W7gsNHQ}!KD$FO"63Z<8NXk<k&Y<9Nh}Yr2H7F

/@5$#

setup_env =.9/jWHrBT7F"Tivoli BINDIR D-Qtr_j7^9#

60 P<8gs 3 jj<9 8

Prolog �)��Risk Manager O TEC k<k&;CH*hSX"9k Prolog 3<IH7FjXh}r$sW

jasH7^9#Risk Manager O"77$$YsHN;CHrX8U1k?aK(~KHQ

G-k{8Nk<krs!7^9#Risk Manager O=._jpsrl"N Prolog U!/H

H7F==7^9#

i|_jU!$k (boot.rls) O Prolog U!$krm<I7^9#h}O TEC k<k&(

s8sbGBT5l^9#

TEC Correlation r$s9H<k7Fi|=.9kH-K"Risk Manager O=.U!$kKG

U)kHMr_j7^9#Risk Manager TEC Correlation rHQ9kH-K""i<`,?9

.?j/J9.?j9klgKO"3liNMr409k3H,G-^9#

k<k&U!$kOT87J$G/@5$#=NeojK"Prolog U!$krT87F"TEC

Correlation r=.7^9#

Prolog U!$k> HQ\*

riskmgr_hosts.pro k<kh}KX9k[9H*hS;s5<NpsrjA7^9#3N

U!$kbN!N=._jMrQ99k3H,G-^9#

¶ [9H&^7s

¶ Hi9FCI&[9H&^7s

¶ ;s5<&$s9?s9 ($s9?s9n.NJAc<*hS5

kb^`)

riskmgr_parameters.pro Server Correlation K_jG-kQia<?<rjA7^9#

riskmgr_thresholds.pro uV$YsHNn.KX"7?7-$MrjA7^9#

82Z<8NX(9+l<7gs7-$MN_jYr2H7F/@5

$#

riskmgr_links.pro $C)N RM_SensorEvent $YsHNVNX8rjA7^9#

riskmgr_categories.pro Risk Manager +F4j<rjA7^9#Risk Manager Server

Correlation O=l>lN$C) RM_SensorEvent r+F4j<K

~l^9#

=._jMrQ99kH-KO"!NvAK1U7F/@5$#

¶ psN9Hjs0O"1lzQd (' ') GO^J1lPJj^;s#

¶ tMO1lzQdGO`,WO"j^;s#

¶ Tj*I (.) G=l>lN Prolog U!/Hr*;7^9#

¶ gLNPGz-tj9HrO_^9#

¶ =l>lN Prolog U!/HO!NA0K>$^9#

fact_name (arg1,arg2,...,argN).

3liNU!$krT87?eO"rmcorr_cfg =.7'k&Wm0i`rFBT9k,W,

"j^9#Risk Manager rF=.9kKO"!NH*j~O7^9#

rmcorr_cfg -reconfig


5.R

iskM

anag

erS

erverC

orrelatio

n

Risk Manager Server Correlation ��Tivoli "I_K9Hl<?<O"Risk Manager Server Correlation KD$F"3N;/7gs

Gb@9knHrBT7^9#?9/O!NH*jG9#

¶ 63Z<8NXk<k&Y<9Nh}Y

¶ 63Z<8NXRisk Manager 3s]<MsHNu7N=(Y

¶ 64Z<8NXRisk Manager 3s]<MsHN$YsH&5<P<+iN|nY

¶ 64Z<8NXRisk Manager Server Correlation 9/jWHNBTY

¶ 64Z<8NXuV$YsHNbK?<Y

¶ 64Z<8NXMCHo</&[9HNjAY

¶ 65Z<8NXHi9FCI&[9HNP?Y

¶ 66Z<8NX;s5<&$s9?s9NXjY

¶ 67Z<8NX;s5<&$s9?s9&$YsHNEgYN@&s0l<IY

¶ 67Z<8NX;s5<&$s9?s9&$YsHN8.N^)Y

¶ 68Z<8NXvF5lk?$`&9?sWQLN_jY

¶ 69Z<8NXuVN-z|B,ZlkPa~VN_jY

¶ 70Z<8NX-z|B,Zl?uVr/j<s"CW9k?aN~VVVN_jY

¶ 70Z<8NXjUlC7e&?$^<N~VVVN_jY

¶ 71Z<8NXlL*JbN+iqN*JbNXNuV$YsHN40Y

¶ 71Z<8NXqN*JbN+ilL*JbNXNuV$YsHN40Y

¶ 72Z<8NX:jMN_jY

¶ 72Z<8NXs;-e"&$YsHN|nY

¶ 73Z<8NXuVG<?N>wY

¶ 73Z<8NXuVG<?r>w9k~|N_jY

¶ 73Z<8NXuVG<?NLN$YsH&5<P<XN>wY

¶ 74Z<8NX9H<`&$YsHN7-$MNjAY

¶ 75Z<8NX$YsHNjs/Y

¶ 76Z<8NXE#$YsHN!PY

¶ 77Z<8NX77$+F4j<NXjY

¶ 79Z<8NX9<Q</i9&+F4j<NdjvFY

¶ 81Z<8NXj<U&/i9N+F4j<XNdjvFY

¶ 81Z<8NXCjN$YsH&/i9KD$FjXWm;9rHQTDK9kY

¶ 82Z<8NX(9+l<7gs7-$MN_jY

62 P<8gs 3 jj<9 8

��3N;/7gsGO"rmcorr_cfg rHQ7FBTG-k"Risk Manager k<k&Y<9KX

89k$YsH&5<P<X"NI}Q?9/KD$Fb@7^9#Risk Manager 3s]<

MsHrP]H7FBT9k3H,G-k=N>N?9/KD$Fbb@7^9#

¶ {8Nk<k&Y<9N$s9H<kHm<I

¶ 7,k<k&Y<9Nn.

¶ =Tk<k&Y<9N97

¶ Risk Manager 3s]<MsHNu7N=(

¶ Risk Manager 3s]<MsHN$YsH&5<P<+iN|n

5<P<Kk<k&Y<9,$s9H<k5lF$k+I&+rN'9kKO"!N3^sI

rHQ7^9#

rmcorr_cfg -status

��1��

Risk Manager jX3s]<MsHr{8Nk<k&Y<9K$s9H<k7Fm<I9kK

O"!Nh&K~O7^9#

rmcorr_cfg -install -dir directory -exist existing_rulebase

F`\O"!NH*jG9#

directory

7,k<k&Y<9r]I9kU!$krXj7^9#

existing_rulebase

{8Nk<k&Y<9N>0rXj7^9#

��

Risk Manager jX3s]<MsHr^`k<k&Y<9rn.9kKO"!Nh&K~O7

^9#

rmcorr_cfg -install -dir directory -new new_rulebase

F`\O"!NH*jG9#

directory

7,k<k&Y<9&U!$kr]I9kG#l/Hj<rXj7^9#

new_rulebase

7?Kn.5lkk<k&Y<9N>0rXj7^9#

��

=TNk<k&Y<9r Risk Manager BAROC Hk<kpsG979kKO"!NH*j

rmcorr_cfg Wm0i`rBT7^9#

rmcorr_cfg -update

Risk Manager '��(��

Risk Manager 3s]<MsHNu7r=(9kKO"!NH*j rmcorr_cfg Wm0i`rBT7^9#


5.R

iskM

anag

erS

erverC

orrelatio

n

rmcorr_cfg -status

Risk Manager '��(��

Risk Manager 3s]<MsHr=TN TEC $YsH&5<P<+i|n9kKO"!NH

*j rmcorr_cfg Wm0i`rBT7^9#

rmcorr_cfg -uninstall

^?O"

Risk Manager 3s]<MsHr=TN TEC $YsH&5<P<+i|n7F"GU)k

H&k<k&Y<9rm<I9kKO"!NH*j rmcorr_cfg Wm0i`rBT7^9#

rmcorr_cfg -delete

Risk Manager Server Correlation ��

m: Risk Manager Gs!5lkk<k&;CHrQ97J$G/@5$#Risk Manager Nj

Xk<k&Y<9r$s9H<k^?O979kKO"rmcorr_cfg Wm0i`rBT7

^9#

TEC Correlation r=.9kKO"{8Nk<k&Y<9K Risk Manager NjX3s]<M

sHrm<I9k+"^?O Risk Manager NjX3s]<MsHr^`7,Nk<k&Y<

9rn.7^9#

7,Nk<k&Y<9rn.9klgO"rmcorr_cfg -exist *W7gsrHQ7F"{8N

k<k&Y<9 (*W7gJk) rXj9k3H,G-^9#3lrXj9kH"Risk

Manager O"Default H$&>0NGU)kHNk<k&Y<9GOJ/"{8Nk<k&Y

<9KpE$F7,Nk<k&Y<9rn.7^9#

=.U!$kN=8N\YKD$FO"60Z<8NXRisk Manager =.9/jWHYr2H

7F/@5$#

k<k&Y<9rn.^?Om<I7?e"Risk Manager G-N$YsH&0k<Wr"I

_K9Hl<?<KdjvF^9#"I_K9Hl<7gsNrdN\YKD$FO"

VTivoli Enterprise Console f<6<:&,$IWr2H7F/@5$#

��23��;s5<O"T3Jh0r!P9kH"G<?r}87"=lr TEC K>w7^9#Risk

Manager O"3liN$YsHrh}7"Q?<sr!w7"uV$YsHNAG"i<`r

8.7^9#uV$YsHO"TEC G=(9k3H,G-^9#

uV$YsHN\YKD$FO"57Z<8NXuVYr2H7F/@5$#

(+4��5��Risk Manager GO"$C)N;s5<&$YsH,u.5lkH"[9Hps,0*K=L

5l"_Q5l^9#?@7";s5<&$YsHbNps,T04Jlgb"j^9#;s

5<&$YsHKO"[9H>,~CF$kbNN"IP "Il9,~CF$J$3Hb"l

P"IP "Il9,~CF$kbNN"[9H>,~CF$J$3Hb"j^9#

riskmgr_hosts.pro U!$kN set_host (sHj<rHQ9kH"MCHo</eN{NN

^7sKD$FN04J[9Hps (IP "Il9H[9H>) rjA9k3H,G-^9#

64 P<8gs 3 jj<9 8

Risk Manager ,04J[9HpsrNBK~jG-kh&K7?j"#tNMCHo</&

$s?<U'<9^?O#tNL>r}D^7sKD$FN[9HpsrjA7?j9kK

O"set_host (sHj<rHQ7F/@5$#

MCHo</&[9H&^7srXj9kKO"!Nh&K7^9#

1. riskmgr_hosts.pro U!$krT87"MCHo</&[9H&^7s4HKL9N(s

Hj<rIC7^9#

set_host('host_ipaddress','hostname').

F`\O"!NH*jG9#

host_ipaddress [9H&^7sN IP "Il9rXj7^9#?H(P"'1.2.111.23' J

IG9#

hostname [9H&^7sN?aKHQ5lk>0rXj7^9#?H(P"

'machine.company.com' JIG9#

9Hjs0O1lzQdNPGO^J1lPJi:"U!/HN*ojKOTj*I (.)rXj7J1lPJj^;s#

2. ,WG"lP"!Nh&K"18H</srHQ9k#tN[9HrjA7^9#

/* Multihomed: */set_host ('1.1.111.11','my.machine1.com').set_host ('10.10.10.11','my.machine1.com').

/* Aliases: */set_host ('1.1.111.12','my.machine2.com').set_host ('1.1.111.12','othermachine2com').

#tN(sHj<r}D[9HNlg"0iU#+k&f<6<&$s?<U'<9

(GUI) K=(5lk>0^?O IP "Il9O"GiKjA5l?[9H>^?O IP "

Il9G9#

3. F=.rT$"Q9r-zK9kKO"!NH*j~O7^9#


*��+��5��Risk Manager GO"CjNHi9FCI&[9H+iN"/F#SF#<r5k9k?aN

=.rT&3H,G-^9#TEC Correlation O"riskmgr_hosts.pro =.U!$kGHi9

FCIH7FXj5l?=<9&[9H+iN"/F#SF#<r!P9kH"

RM_TrustedHost $YsHr8.7^9#TEC Correlation GO"8h^7sH70KAc<

Nl3<I,]85l^9,"[9H,Hi9FCIG"k?a"psNjXOTol^;

s#

Hi9FCI&[9HrP?9kKO"!Nh&K7^9#

1. riskmgr_hosts.pro U!$krT87"!NA0rHQ7FHi9FCI&[9H4HK

L9N(sHj<rIC7^9#

set_trusted_host('host_ipaddress','hostname').

F`\O"!NH*jG9#


5.R

iskM

anag

erS

erverC

orrelatio

n

host_ipaddress

[9H&^7sN IP "Il9rXj7^9#?H(P"'1.2.111.23' JIG

9#

hostname

[9H&^7sQKHQ9k>0rXj7^9#?H(P"

'machine_name.company.com' JIG9#




$YsHO"TEC N RM_TrustedHosts 3sFJ<bK=(5l^9#

&��Risk Manager GO";s5<&$s9?s9rjA9k?aN=.rT&3H,G-^9#

;s5<HO"Risk Manager _9"@W?<rHQ9k$YsH&bK?<&"Wj1<7

gsG9#Risk Manager GO"_9"@W?<N;CHbQU5lF$^97"H+N"@

W?<rn.9k3HbG-^9#H+N"@W?<rn.9klgKO"VTivoli Risk

Manager GYmCQ<:&,$IWr2H7F/@5$#

;s5<rXj9kKO"!Nh&K7^9#

1. riskmgr_hosts.pro U!$krT87"!NA0rHQ7F;s5<4HKL9N(sH

j<rIC7^9#

set_sensor('sensor_type','host_ipaddress','hostname').

F`\O"!NH*jG9#

sensor_type

;s5<N?$WrXj7^9#?H(P"webids JIG9#

host_ipaddress

[9H&^7sN IP "Il9rXj7^9#?H(P"'1.2.133.23' JIG

9#

hostname

[9H&^7sQKHQ9k>0rXj7^9#?H(P"

'machine_name.company.com' JIG9#

9Hjs0O1lzQdNPGO^J1lPJi:"U!/HN*ojKOTj*I (.)rXj7J1lPJj^;s#IC9k set_sensor (sHj<O"IN set_host (sHj<HblW9k,WO"j^;s#



$YsHO"TEC $YsH&3s=<kN RM_Sensors $YsH&0k<WbK=(5l

^9#

66 P<8gs 3 jj<9 8

&��6��Risk Manager O"EgYr(9?aK$YsHr,`7^9#v0jANEgYlYkO"

!NH*jG9 (EgYNb$bN+igKj9H7^9)#

FATAL"CRITICAL"MINOR"WARNING"HARMLESS"*hS UNKNOWN#

jXWm;9G"riskmgr_hosts.pro U!$kG=.5lF$J$;s5<,!P5lkH"

TEC Correlation O";s5<&$s9?s9 (RM_Sensor) $YsHr8.7"$YsHK

D$FNGU)kHNEgY (WARNING) r+0*KdjvF^9#=.U!$kG;s5

<rjA9kKO"set_sensor _jrHQ7^9#

;s5<NGU)kHN$YsHEgYr HARMLESS K@&s0l<I9kKO"!Nh

&K7^9#

1. riskmgr_hosts.pro U!$krT87"!N(sHj<rIC7^9#

set_downgrade_sensor_creation('sensor_type').

sensor_type O";s5<N?$WrXj7^9#;s5<HO"Risk Manager _9"@W

?<rHQ9k$YsH&bK?<&"Wj1<7gs (?H(P"'webids') G9#




$YsHO"TEC N RM_Sensor $YsH&0k<WbK=(5l^9#

&��Risk Manager GO"CjN;s5<&?$WKD$F;s5<&$s9?s9&$YsHN

8.r^)9k?aN=.rT&3H,G-^9#Lo"jXWm;9G;s5<,!P5l

kH"TEC Correlation O RM_Sensor $YsHr8.7^9#

;s5<&$s9?s9&$YsHN8.r^)9kKO"!Nh&K7^9#

1. riskmgr_hosts.pro U!$krT87F"!Nh&J(sHj<rIC7^9#

set_ignore_sensor_creation('sensor_type').

sensor_type KO";s5<N?$WrXj7^9#




��$YsHrsp9k;s5<N?$W"^?O8h[9HK~8"CjNMK0-r_j9k

3H,G-^9#

^?"CjN[9H+i/89k$YsHd"CjN[9HKP9k$YsHNlYkrQ9

9k3HbG-^9#


5.R

iskM

anag

erS

erverC

orrelatio

n

0-rjA9kKO"TEC ^?O Risk Manager 5<P<G riskmgr_parameters.pro U!

$krT87FQ97^9#

!Nh&KU)<^CHr_j7^9#

attribute_map(attrib_to_set,value_to_use,attrib_to_compare,compare_value,attrib_to_compare,compare_value2).

!Kcr(7^9#

attribute_map('severity','HARMLESS','rm_SourceIPAddr','9.3.32.1','rm_SensorType','webids').

3NTKhj"rm_SourceIPAddr , 9.3.32.1 G rm_SensorType , webids NlgK"EgY

0-, HARMLESS K_j5l^9#

attribute_map('severity','CRITICAL','rm_SensorType','CPFW','rm_Level','5').

3NTKhj"rm_SensorType , CPFW G rm_Level , 5 NlgK"EgY0-,

CRITICAL K_j5l^9#

0-rHQ9k3HKhj"$YsHr1L7F"3lr+9?^< ID K^CW9k3H,

G-^9#?H(P"QKK$YsHr/89k^7s,"kH7^9#"kf<6<r"h

j\YKbK?<7J1lPJiJ$H7^9#=Nf<6<KD$FO"0- rm_Level N

Mrb/_j9k3H,G-^9#

!Nh&K7^9#

$YsH0-r_j^?OQ99kKO"riskmgr_parameters.pro U!$krT87F0-

rQ97^9#!NcO"GU)kHMr(7F$^9#

¶ Cisco k<?<Nlg:

attribute_map('severity','WARNING','rm_Level',1,'rm_SensorType','csids').attribute_map('severity','WARNING','rm_Level',2,'rm_SensorType','csids').attribute_map('severity','MINOR','rm_Level',3,'rm_SensorType','csids').attribute_map('severity','MINOR','rm_Level',4,'rm_SensorType','csids').attribute_map('severity','CRITICAL','rm_Level',5,'rm_SensorType','csids').

¶ Internet Security Systems RealSecure (ISS RealSecure) Nlg:

attribute_map('severity','WARNING','rm_Priority','Low','rm_SensorType','realsecure').attribute_map('rm_Level',1.0,'rm_Priority','Low','rm_SensorType','realsecure').

attribute_map('severity','MINOR','rm_Priority','Medium','rm_SensorType','realsecure').attribute_map('rm_Level',3.0,'rm_Priority','Medium','rm_SensorType','realsecure').

attribute_map('severity','CRITICAL','rm_Priority','High','rm_SensorType','realsecure').attribute_map('rm_Level',5.0,'rm_Priority','High','rm_SensorType','realsecure').

F=.rT$"Q9r-zK9kKO"!NH*j~O7^9#


��$/D+N=.*W7gsrHQ9k3HKhj"C1LG~VVVr_j9k3H,G-^

9# 69Z<8N=11 rHQ7F"lL*J~VVVrCKQ97^9#

68 P<8gs 3 jj<9 8

= 11. ~VVVrCKQ9

~VVV C

1 , 60 C

5 , 300 C

10 , 600 C

30 , 1800 C

1 ~V 3600 C

2 ~V 7200 C

12 ~V 43200 C

1 | 86400 C

1 5V 604800 C

1 vn (4 5V) 2419200 C

Risk Manager GO"$YsH,$YsH&5<P<K~e7?H-KvF5lk?$`&9

?sWQLr)f9k?aN=.rT&3H,G-^9#18G<?&9Hj<`bN$Ys

HNVVH7Fu1~lD=JCtr=G7"3NtMr riskmgr_parameters.pro U!$k

G_j9k3H,G-^9#

jXWm;9O"vF5lk?$`&9?sWQLrHQ7F"$YsH&5<P<Gu.5

l?$YsHN?$`&9?sW&U#<kI,"189Hj<`bN>N$YsHHg}K

[JCF$J$+I&+A'C/7^9#jXWm;9G"18G<?&9Hj<`bN 2

DN$YsHVN?$`&9?sWVV,g-9.k3H,!P5lkH"TEC Correlation

O RM_InputErr c0r8.7^9#Risk Manager O"gxU1r last_timestamp Kj;CH7^9#

vF5lk?$`&9?sWQLrXj9kKO"!Nh&K7^9#

1. riskmgr_parameters.pro U!$krT87"!NA0rHQ7FCtrQ97^9#

set_timestamp_jitter(seconds).

seconds QtO"18G<?&9Hj<`bN$YsHNVVH7FvF5lk~V (C1

L) G9#

GU)kH_jO 1 | (86400 C) G9#

seconds MO"0 hjg-J0tGJ1lPJj^;s#U!/HN*ojKO"Tj*I

(.) rXj7J1lPJj^;s#

lL*JC1LN~VVVKD$FO"=11 r2H7F/@5$#



$YsHO"TEC N RM_Exceptions $YsH&0k<WbK=(5l^9#

��Risk Manager GO"uVN-z|B,ZlkPa~VrXj9k?aN=.rT&3H,G

-^9#


5.R

iskM

anag

erS

erverC

orrelatio

n

jXWm;9G"Xj5l?~VNPaeKuVU!/H,Q95lF$J$3H,!P5l

kH" TEC Correlation O"=NuVU!/Hr prolog U!/H&Y<9+i|n7^9#

Risk Manager O"P~9k"-z|B,Zl?uV$YsHNu7r CLOSED Kj;CH7"EgYr UNKNOWN Kj;CH7^9#

uVN-z|B,ZlkPa~VrXj9kKO"!Nh&K7^9#


set_situation_expiration(seconds).

seconds QtKO"uVN-z|B,ZlkPa~VrXj7^9#GU)kH_jO

86400 CG9#

seconds MO"60 JeN0tGJ1lPJj^;s#U!/HN*ojKO"Tj*I (.)rXj7J1lPJj^;s#

lL*JC1LN~VVVKD$FO"69Z<8N=11 r2H7F/@5$#



��+��Risk Manager GO"-z|B,Zl?uVU!/HNA'C/*hS/j<s"CWNHj

,<VVH7FvF5lk~V (C1L) r)f9k?aN=.rT&3H,G-^9#u1

~lD=JCtr=G7"=lr riskmgr_parameters.pro U!$kG_j9k3H,G-^

9#

jXWm;9G"~VVV,6a5lF$k3H,!P5lkH"TEC Correlation O"-z

|B,Zl?uVU!/H,J$+I&+A'C/7"=liNU!/HN/j<s"CWr

+O7^9#

-z|B,Zl?uV,J$+I&+A'C/9k?aN~VVVrXj9kKO"!Nh&

K7^9#


set_situation_cleanup_interval(seconds).

seconds QtKO"-z|B,Zl?uV$YsHN/j<s"CW,/05lk^GN~

V (C1L) rXj7^9#GU)kH_jO 3600 CG9#

seconds MO"60 CJeN0tGJ1lPJj^;s#U!/HN*ojKO"Tj*I

(.) rXj7J1lPJj^;s#




��+�#��!��Risk Manager GO"jUlC7e&?$^<NHj,<VVH7FvF5lk~V (C1L)

r)f9k?aN=.rT&3H,G-^9#3N~VVVO"riskmgr_parameters.pro U

!$kGXj9k3H,G-^9#

70 P<8gs 3 jj<9 8

jXWm;9G"~VVV,6a7F$k3H,!P5lkH"uV$YsH,975l"=

li,F,ON?aKBTMj5l"$YsH&3s=<kK=(5lF$k$YsH,jU

lC7e5l^9#

$YsHrjUlC7e9k?aN~VVVrXj9kKO"!Nh&K7^9#


set_interface_refresh(seconds).

seconds QtKO"-z|B,Zl?uV$YsHN/j<s"CW,/05lk^GN~

V (C1L) rXj7^9#GU)kH_jO 60 CG9#

seconds MO"10 Chjg-$0tGJ1lPJj^;s#U!/HN*ojKO"Tj

*I (.) rXj7J1lPJj^;s#




��Risk Manager GO"hjqN*JuV$YsHr*V?aK"hjFQ*JuV$YsHr

|n9kWm;9r409k?aN=.rT&3H,G-^9# ratio_down 8tO"{8

NuV 1 ^?O 2 r*V?aK"uV 2 ^?O 3 ,|n5lk~|r)f7^9#3N8

tO"Lo"1.0 Ka$M (0.90 d 0.95 JI) G9#

|nWm;9O"riskmgr_parameters.pro U!$kG409k3H,G-^9#

uV$YsHrlL*JbN+iqN*JbNX409k3HrXj9kKO"!Nh&K7

^9#

1. riskmgr_parameters.pro U!$krT87"!NA0rHQ7FtMrQ97^9#

set_ratio_down(0.95).

set_ratio_down NMO"1.0 J<GJ1lPJi:" 0.0 A 1.0 NOOKBj5l^

9#tMrTj*IG*oi;k3HOG-^;s (?H(P"1.)#GU)kH_jO

0.95 G9#

U!/HN*ojKO"Tj*I (.) rXj7J1lPJj^;s#



��Risk Manager GO"hjlL*JuV$YsHr*V?aK"hjqN*JuV$YsHr

|n9kWm;9r409k?aN=.rT&3H,G-^9#ratio_up 8tO"uV 1 ^

?O 2 ,"^^lF$kuV,9YF,uV 2 *hSuV 3 (^?OuV 2) NbNhj+

Jjc$?aK|n5lk~|r)f7^9#LoO"3lO"1.0 hj+Jjc$M (0.25

d 0.5 JI) G9#

|nWm;9O"riskmgr_parameters.pro U!$kG409k3H,G-^9#


5.R

iskM

anag

erS

erverC

orrelatio

n

uV$YsHrqN*JbN+ilL*JbNX409k3HrXj9kKO"!Nh&K7

^9#

1. riskmgr_parameters.pro U!$krT87"!NA0rHQ7FtMrQ97^9#

set_ratio_up(n.nn).

n.nn O"set_ratio_up NtMr=7^9#3NtMO"1.0 J<GJ1lPJi:"

0.0 A 1.0 NOOK)B5l^9#tMrTj*IG*oi;k3HOG-^;s (?H

(P"1.)#GU)kH_jO 0.25 G9#




��Risk Manager GO"uVr979k77$$YsH,~e7J$H-K"uVNEgYlY

k,c<9k.5r)f9k?aN=.rT&3H,G-^9#

?H(P":jM, 600 CK_j5lF$F"uV$YsHNlYk, 50.0 NlgK"

600 CV":v9kG<?,u.5lJ$H"EgYlYkO 25.0 Kc<7^9#3Nc

O"~V:j!=GHQ5lk>:|G9#

3N~V:jM (C1L) O"riskmgr_parameters.pro U!$kGXj9k3H,G-^9#

:jMr_j9kKO"!Nh&K7^9#

1. riskmgr_parameters.pro U!$krT87"!NA0rHQ7F:jMrQ97^9#

set_decay_value(seconds).

seconds QtKO"uVr979k77$$YsH,~e7J$H-K"EgYlYk,c

<9k^GN~V (C1L) rXj7^9#GU)kH_jO 7200 CG9#

seconds MO"0tGJ1lPJi:"0 Chjg-/J1lPJj^;s#U!/HN*

ojKO"Tj*I (.) rXj7J1lPJj^;s#



�&"#��drop_unsecure_event O"s;-e" (s Tivoli) RM_SensorEvent $YsHNh}r*

s^?O*UK9k?aKHQ7^9#

Risk Manager GO"riskmgr_parameters.pro U!$kG"3Nh}r)f9k?aN=.r

T&3H,G-^9#

s;-e"&$YsHrh}9k+I&+rXj9kKO"!Nh&K7^9#

1. riskmgr_parameters.pro U!$krT87"!NA0rHQ7FQia<?<r*U+i

*sK"^?O*s+i*UKQ97^9#

drop_unsecure_events(off).

72 P<8gs 3 jj<9 8

GU)kH_jO off G9#*sK9kH"s;-e" (s Tivoli) RM_SensorEvent $YsH,u.5lkH90K|n5lkh&KJj^9#




��uVG<?rLN TEC $YsH&5<P<K>w9kh& Risk Manager r=.9k3H,

G-^9#uV>wN*s / *UNZjX(O"riskmgr_parameters.pro U!$kGXj9

k3H,G-^9#

uV>wN*s / *UrZjX(kKO"!Nh&K7^9#

1. riskmgr_parameters.pro U!$krT87"!NA0rHQ7FQia<?<r*U+i

*sK"^?O*s+i*UKQ97^9#

forward_situations(off).

GU)kH_jO off G9#*sK9kH"uVG<?,LN TEC $YsH&5<P<

K>w5l^9#




��Risk Manager GO"$YsHr TEC $YsH&5<P<Kw.9kVVH7FvF5lk

~Vr)f9k?aN=.rT&3H,G-^9#3N~VVVO"riskmgr_parameters.pro

U!$kGXj9k3H,G-^9#

uVG<?r>w9k?aN~VVVrXj9kKO"!Nh&K7^9#


set_forward_interval(300).

seconds QtKO"uVG<?,>w5lk^GN~V (C1L) rXj7^9#GU)k

H_jO 300 CG9#

seconds MO"10 CJeN0tGJ1lPJj^;s#U!/HN*ojKO"Tj*I

(.) rXj7J1lPJj^;s#



��Risk Manager GO"m<+kuVG<?N>whHJk TEC $YsH&5<P<r)f9

k?aN=.rT&3H,G-^9#


5.R

iskM

anag

erS

erverC

orrelatio

n

uVG<?N>whHJk TEC $YsH&5<P<N>0O"=.U!$kGXj7^9#

=.U!$kNFsWl<HGO"=.U!$k,U!$k>KhCFN_2H5lF*j"

.conf U!$k>H%ROU1ilF$^;s#Gg 50 DN=.U!$k,1~K8_7^

9#

3N$YsH&5<P<O"riskmgr_parameters.pro U!$kGXj9k3H,G-^9#

$YsHrjUlC7e9k?aN~VVVrXj9kKO"!Nh&K7^9#


set_forward_tec(config_file, sensor_type, tec_ipaddr,tec_hostname).

F`\O"!NH*jG9#

config_file

m<+kuVG<?N>whHJk?<2CH TEC $YsH&5<P<rXj9

k?aKHQ5lk=.U!$kN>0#

sensor_type

;s5<&?$WrXj7^9#m<+k TEC $YsH&5<P<O"?<2C

H TEC $YsH&5<P<G;s5<&$s9?s9H7F=(5l^9#;s

5<&$YsH,=(5lJ$h&K9klgO"?<2CH TEC $YsH&5

<P<G ignore_sensor_creation rHQ7F/@5$#

tec_ipaddr

m<+k TEC $YsH&5<P<N IP "Il9rjA7^9#

tec_hostname

m<+k TEC $YsH&5<P<N[9H>rjA7^9#

m: 9YFNQia<?<rXj7J1lPJj^;s#5iK"Qia<?<&9Hj

s0r1lzQdGO^J1lPJj^;s#

?H(P"!NH*jG9#

set_forward_tec('tec_forward','riskmgr','10.10.40.23','my.tecserver.org').




��9H<`&$YsHHO"ping UiCG#s0JI";|VKgLN$YsH,=|5lk

u7G9#Lo"Risk Manager GO"3liN$YsHKP7FG.BNh}rBT7^

9#

;s5<=JGO"?tNDL$YsHKP7FH+Nh}rT$"1lN$YsHrsp9

k3H,?$G9#9H<`&$YsHMr_j9k]KO"3N3HrM8K~lF/@5

$#VmC/7-$M},O",9:i9+"04K|n9k,W,"j^9#

"k$YsH,9H<`&$YsHH7Fh}5lklgO"=lrjs/&$YsH^?O

E#$YsHH7Fh}9k3HOG-^;s#

74 P<8gs 3 jj<9 8

Risk Manager GO"9H<`&$YsHKD$FNVmC/7-$M},r)f9k?aN

=.rT&3H,G-^9#VmC/7-$M},MK#9kH"uVU!/H*hS$Ys

HN0497,Tol^9#3NVmC/7-$MO"riskmgr_links.pro U!$kGXj9

k3H,G-^9#

VmC/7-$MrXj9kKO"!Nh&K7^9#

1. riskmgr_links.pro U!$krT87"!NA0rHQ7FMrXj7^9#

set_storm_events(Classname, Attribute_List,Block_Threshold_List, Block_Threshold_Increment).

F`\O"!NH*jG9#

Classname

/i9N>0rjA7^9#3lO"1lzQdGO^J1lPJj^;s#

Attribute_List

$YsHr9H<`NltH+J9?aKlW5;J1lPJiJ$0-Nj9H

rjA7^9#0-Nj9HKO"=l>l1lzQdGOs@9Hjs0Nj9

HrH_~^J1lPJj^;s#

Block_Threshold_List

0497NBT~KHQ5lk7-$MrjA7^9#MO"0tNj9H (:

g) GJ1lPJj^;s#tMrTj*IG*oi;k3HOG-^;s (?H

(P"5.)#0tNeKO<mrU1J1lPJj^;s (?H(P"25 O 25.0

H7J1lPJj^;s)#

Block_Threshold_Increment

VmC/7-$Mj9HNGeNMK#7?eGHQ5lk7-$M},MrjA

7^9#MO0tGJ1lPJj^;s#tMrTj*IG*oi;k3HOG-

^;s (?H(P"5.)#0tNeKO<mrU1J1lPJj^;s (?H(P"

25 O 25.0 H7J1lPJj^;s)#




9H<`&$YsH&(sHj<O"RM_SensorEvent /i9GjA7^9#!NcGO"

9H<`&$YsH&(sHj<r(7^9#

set_storm_events('RS_TearDrop',['rm_DestinationToken'], [10,50,100,250],250).

��Risk Manager GO"ClJU#r}D"L9N/i9+iN 2 DN$YsHrjs/9k?

aN=.rT&3H,G-^9#?H(P"WW_SuspiciousCgi $YsHNeK"P~9k

WW_Success $YsH,3$?lgO"1HN WW_SuspiciousCgi $YsHhjbEgG"k

H+J9Y-G9#

"k/i9r9H<`&$YsHH7FjA9kH"=lOjs/&$YsHH7Fh}5l

J/Jj^9#"k$YsH,js/&$YsHH7Fh}5lklg"=lOE#$YsH

H7Fh}5l^;s#


5.R

iskM

anag

erS

erverC

orrelatio

n

2 DN$YsHNVNjs/O"riskmgr_links.pro U!$kGXj9k3H,G-^9#

$YsHrjs/9kKO"!Nh&K7^9#


set_linked_events(Classname1, Classname2, Attribute_List,* Severity_Value).

F`\O"!NH*jG9#

Classname1

GiN$YsHN/i9N>0rjA7^9#>0O"1lzQdGO^J1lP

Jj^;s#

Classname2

X"9ke3N$YsHN/i9N>0rjA7^9#>0O"1lzQdGO^

J1lPJj^;s#

Attribute_List

$YsH,X"7F$kH+J5lk?aKlW7J1lPJiJ$0-Nj9H

rjA7^9#=l>lN0-O"1lzQdGO_"3s^G,1J1lPJj

^;s#

Severity_Value

e3N$YsHKD$F"LoNEgYMNeojKHQ9kEgYMrjA7^

9#EgYMO"tM (Bt^?O0t) GJ1lPJj^;s#tMrTj*I

G*oi;k3HOG-^;s (?H(P"5.)#0tNeKO<mrU1J1lP

Jj^;s (?H(P"25 O 25.0 H7J1lPJj^;s)#




!NcGO"RM_SensorEvent /i9re3NX"$YsHKjs/9k(sHj<r(7

^9#

set_linked_events('WW_SuspiciousCgi','WW_Success',['rm_SensorToken','webids_requid'],25.0).

set_linked_events('WW_InsecureCgi','WW_Success',['rm_SensorToken','webids_requid'],20.0).

GiN^CAs06x$YsH,HQ5l^9#e-NcGO"WW_SuspiciousCgi H

WW_InsecureCgi N>}N^CAs06x$YsH,8_9klg" WW_SuspiciousCgi NM

,HQ5l"WW_InsecureCgi NMO5k5l^9#

��E#$YsHO"04JE#H+J5lk$YsHG9#Lo"0-Nj9HKO

rm_Timestamp32 ,H_~^l"$YsH,[\1~K/87F$J1lPJiJ$3Hr

(7^9# rm_Timestamp32 0-NfS~KO"Wi9^?O^$J9 2 CNP9,vF

5l^9#

76 P<8gs 3 jj<9 8

E#9k$YsHNEgYlYk,5N$YsHhjb$lgO"EgYlYkN9rHQ7

FuVU!/H*hS$YsH,975l^9#E#9k$YsHNEgYlYk,5N$Y

sHJ<G"klg"h}OTol^;s#

"k$YsH,9H<`&$YsH^?Ojs/&$YsHH7Fh}5lklg"=lOE

#$YsHH7Fh}5l^;s#

Risk Manager GO"riskmgr_links.pro U!$kG"E#$YsHr!P9k?aN=.r

T&3H,G-^9#

E#$YsHr!P9kKO"!Nh&K7^9#


set_duplicate_events(Classname1, Classname2, Attribute_List).

F`\O"!NH*jG9#

Classname1

$YsH 1 N/i9N>0rjA7^9#>0O"1lzQdGO^J1lPJ

j^;s#

Classname2

$YsH 2 N/i9N>0rjA7^9#>0O"1lzQdGO^J1lPJ

j^;s#

Attribute_List

$YsH,E#7F$kH+J5lk?aKlW7J1lPJiJ$0-Nj9H

rjA7^9#=l>lN0-O"1lzQdGO_"3s^G,1J1lPJj

^;s#




!NcO"RM_SensorEvent /i9,04KE#9k3Hr(9,W,"k(sHj<r(

7F$^9#

set_duplicate_events('NR_WWW_bat_File', 'RS_HTTP_IE_BAT',['rm_Timestamp32','rm_DestinationToken','rm_SourceToken','rm_Url']).

��7�8��77$>0HG-NH</s ID VfrdjvFk3HKhCF"77$ Risk Manager +F

4j<rXj9k3H,G-^9#G<?Y<9!wr1c=9kKO"3liN?$WNu

Vr1L9k?aNG-N;L>rIC7^9#

+F4j<>rjA9kKO"!Nh&K7^9#

1. riskmgr_categories.pro U!$krT87"!NA0rHQ7F+F4j<>4HKL9

N(sHj<rIC7^9#

set_category_name(categ_nnnnn,'long_name','short_name').

F`\O"!NH*jG9#


5.R

iskM

anag

erS

erverC

orrelatio

n

categ_nnnnn

+F4j<KdjvFilkG-NH</srXj9k9Hjs0#3NG-NH

</sKhj"/~!N79F`N?$W,1L5l^9#?H(P"

categ_00001 OH</sG" 00001 O Web X"N"i<HKdjvFilk+

F4j<VfG9# categ_ GO^k+F4j<r1lzQdGO`,WO"j

^;s#?H(P"set_category_name (categ_00001, 'Web Attack', 'WEB'). H

Jj^9#

long_name

+F4j<N?aKHQ5lk04J>0rXj9k9Hjs0 (?H(P"

'Network Management')#9$>0O"uV$YsHN rm_Key1Str"rm_Key2Str"*hS rm_key3Str 0-GHQ5l^9#

short_name

+F4j<N?aKHQ5lkG-N;L>rXj9k9Hjs0#?H(P"

'NETMAN' O Network Management N;LP<8gsG9#

9$>0H;L>N9Hjs0O1lzQdNPGO^J1lPJi:"U!/HN*o

jKOTj*I (.) rXj7J1lPJj^;s#



GU)kHGO"J<N+F4j<,jA5lF$^9#

= 12. Risk Manager KhjjA5lk+F4j<

+F4j< 9$>0 ;L>

categ_00001 Web Attack (Web 6b) WEB

categ_00002 Network Mgmt Activity (MCH

o</I}"/F#SF#<)

NETMAN

categ_00003 EMail Activity (E a<k&"/

F#SF#<)

EMAIL

categ_00004 User-Level Activity (f<6<&

lYk&"/F#SF#<)

USER

categ_00005 Targeted DOS (?<2CHP]

DOS)

TDOS

categ_00006 Service Compromise (5<S9N

E()

SERVCMP

categ_00007 Trojan Horse (Hm$NO) TROJ

categ_00008 Command-Level Activity (3^s

I&lYk&"/F#SF#<)

CMD

categ_00100 Service Attack (5<S96b) SERV

categ_00101 Denial of Service (5<S982) DOS

categ_00200 Virus Activity (&#k9&"/F

#SF#<)

VIRUS

categ_05000 Network Level Attack (MCHo

</&lYk6b)

NETLVL

categ_05001 Host-Level Attack ([9H&lY

k6b)

HOSTLVL

categ_05002 Resource Alert (j=<9&"i

<H)

RESOURCE

78 P<8gs 3 jj<9 8

= 12. Risk Manager KhjjA5lk+F4j< (3-)

+F4j< 9$>0 ;L>

categ_10000 IDS Level (IDS lYk) IDSLVL

categ_10001 Misc Level (Misc iYk) MISCLVL

categ_10100 Authentication Activity ('Z"/

F#SF#<)

SECAUTH

categ_10101 Access Control ("/;9&3s

Hm<k)

SECACCESS

categ_10102 Security Policy (;-ejF#

<&]j7<)

SECPOLICY

categ_10103 Security Admin (;-ejF#<

I})

SECADMIN

categ_10110 Configuration Change (=.Q9) CONFIG

categ_10111 Installation ($s9H<k) INSTALL

categ_10112 State Change (uVQ9) STATECHG

categ_10113 System Error (79F`&(i<) SYSERROR

��*��7�8�� 9<Q</i9&+F4j<NdjvFrXj9k3HKhCF"+F4j<K

RM_SensorEvent /i9rdjvFk3H,G-^9#qN-Nb$bN+igKXj7F

/@5$#77$>0HG-NH</s ID VfrdjvFk3HKhCF"77$ Risk

Manager +F4j<rXj9k3H,G-^9#Risk Manager jAN+F4j<Nj9HK

D$FO"77Z<8NX77$+F4j<NXjYr2H7F/@5$#

9<Q</i9&+F4j<rdjvFkKO"!Nh&K7^9#

1. riskmgr_categories.pro U!$krT87"!NA0rHQ7F+F4j<>4HKL9

N(sHj<rIC7^9#

category_assign_super(categ_nnnnn, 'class_name').

F`\O"!NH*jG9#

categ_nnnnn


</sKhj"/~!N79F`N?$W,1L5l^9#?H(P"



^;s#

class_name

9<Q</i9N>0rXj9k9Hjs0#hjqN*JdjvF,TolF$

J$Bj"+F4j<N9<Q</i9+i3P5lkj<U&/i9b+F4j

<KdjvFil^9#

H</s^?O/i9>N9Hjs0O1lzQdNPGO^J1lPJi:"U!/H

N*ojKOTj*I (.) rXj7J1lPJj^;s#




5.R

iskM

anag

erS

erverC

orrelatio

n

Risk Manager GO"GU)kHKhCF"J<N9<Q</i9&+F4j<,djvFi

l^9#

category_assign_super (categ_00001, ’RM_WebServer’).

category_assign_super (categ_00002, ’RM_SNMP’).

category_assign_super (categ_00003, ’RM_Email’).

category_assign_super (categ_00004, ’RM_User’).

category_assign_super (categ_00005, ’RM_TDoS’).

category_assign_super (categ_00006, ’RM_ServiceCompromise’).

category_assign_super (categ_00007, ’RM_Trojan’).

category_assign_super (categ_00008, ’RM_Command’).

category_assign_super (categ_00100, ’RM_Service’).

category_assign_super (categ_00100, ’RM_Scan’).

category_assign_super (categ_00101, ’RM_Flood’).

category_assign_super (categ_00200, ’RM_HostVirus’).

category_assign_super (categ_05000, ’RM_IDSNetwork’).

category_assign_super (categ_05001, ’RM_IDSHost’).

category_assign_super (categ_05002, ’RM_HostResource’).

category_assign_super (categ_10100, ’RM_SecAuth’).

category_assign_super (categ_10101, ’RM_SecAccess’).

category_assign_super (categ_10102, ’RM_SecPolicy’).

category_assign_super (categ_10103, ’RM_SecAdmin’).

category_assign_super (categ_10110, ’RM_Configuration’).

category_assign_super (categ_10111, ’RM_Installation’).

category_assign_super (categ_10112, ’RM_StateChange’).

category_assign_super (categ_10113, ’RM_SysError’).

/* Do NOT change the order of the following three facts.

* These must be the last three assignments made.

*/

category_assign_super (categ_10000, ’RM_IDSEvent’).

category_assign_super (categ_10001, ’RM_MiscEvent’).

category_assign_super (categ_99999, ’RM_SensorEvent’).

m: category_assign_super U!/HNgxKOmU9k,W,"j^9#

category_assign U!/HH7F@(*K+F4j<KdjvFilF$J$F Risk

Manager $YsH&/i9O"category_assign_super U!/HKpE-/i9&+F

4j<,djvFil^9#category_assign KhCFCK_j5lF$J$$Ys

H&/i9KO"GiK^CA9k category_assign_super U!/H,HQ5l^9#

category_assign_super U!/HO">N9<Q</i9N5V/i9G"k9<Q<&/

i9,GiK=lkh&[s9k,W,"j^9# RM_IDSEvent"RM_MiscEvent"*hSRM_SensorEvent KX"U1il?+F4j<,"GeN 3 DN category_assign_superU!/HHJkh&K7J1lPJj^;s#

80 P<8gs 3 jj<9 8

m: 18+F4j<K#tN/i9>rdjvFk3H,G-^9#

��*��7�8�� j<U&/i9r+F4j<KdjvFkKO"G-NH</s ID VfrXj7"Xj5l

?+F4j<KdjvFilF$kj<U&/i9Nj9HrIC7^9#

j<U&/i9&+F4j<rdjvFkKO"!Nh&K7^9#

1. riskmgr_categories.pro U!$krT87"J<NA0K7?,CFFdjvF4HKL

9N`\rIC7^9#

category_assign(categ_nnnnn,'class_list').

F`\O"!NH*jG9#

categ_nnnnn


</sKhj"/~!N79F`N?$W,1L5l^9#?H(P"



^;s#

class_list

+F4j<KdjvFilF$kj<U&/i9rXj9k9Hjs0Nj9H#

j<U&/i9O"/i9,XNG<XK"j^9#j<U&/i9HO"LN/

i9NY<9&/i9H7FHQ5l?3HNJ$/i9N3HG9#?H(P"

!Nh&K~O7^9#

category_assign(categ_00003, (['RS_Email_Expn','RS_Email_Decode','RS_Email_Debug','RS_Email_Wiz']).

+F4j<^?Oj<U&/i9N9Hjs0O",:zQdNPGO_"U!/HNG

eKTj*I ( .) rXj9k,W,"j^9#



��*��!� ��1&��RM_SensorEvent rQ59k/i9OIlb"jXrHQTDK9k3H,G-^9#

jXWm;9rHQTDK9kKO"!Nh&K7^9#

1. Q99k/i9r^` BAROC U!$krT87^9#

2. rm_Correlate U#<kIG"GU)kHMr no KQ97^9#

rm_Correlate : default=no;

$YsH8.GHQG-kh&K9kKO"GU)kHMr yes K_j7^9#

rm_Correlate : default=yes;

3. BAROC U!$kNT8*hS]IeK TEC Correlation r979kKO"!NH*j~

O7^9#

rmcorr_cfg -update


5.R

iskM

anag

erS

erverC

orrelatio

n

3NMO"CjN"@W?<KP7F_j9k3H,G-^9#F=.9k"@W?<NI-

easF<7gsr2H7F/@5$#

9�7��%��l"N$YsH,"i<`u7K(9+l<H9k~|r)f9k7-$MrjA9k3H,

G-^9# TEC Correlation GO""i<`,/89kQYr)f9k?aK"7-$M_j

,HQ5l^9#_jO"jX5lk9YFN$YsHKFA7^9#

_jr407F"CjN[9H^?O6bN?$WKX"7?"i<`,/89kQYre2

?j"<2?j9k3H,G-^9# TEC Correlation r,ZK407J$H"$YsH&3

s=<kK=(5lk$YsH,?9.?j"/J9.?j9k3HKJj^9#40rT&

KO"MCHo</&;-ejF#<NP3,,WG9#

rm_Level 0-O"7-$MjAHX8,"j^9#?H(P"$YsH&3s=<k,;|

VKs 20 DN$YsHru.7"$YsH&/i9, rm_Level=1.0 NEgYlYkG"

7-$MN_j,!NbNG"kH"

set_threshold('situation1',_,5,20,100,200,_,_,_).

jXWm;9Khj"EgYlYk WARNING N RM_Situation1 $YsH,8.5l^

9#

Risk Manager Correlation GO"=.U!$k riskmgr_thresholds.pro G7-$M_jrj

A7^9#

=._jrQ99kKO"riskmgr_thresholds.pro U!$krT87F"J<NA0G(s

Hj<rQ9^?OIC7^9#T8N0K"GU)kHN riskmgr_thresholds.pro U!$

kNPC/"CW&3T<rn.7F/@5$#

m: U!/HN*ojKO"Tj*I (.) rH_~^J1lPJj^;s#

F`\O"!NH*jG9#

set_threshold(situation,situation_type,thresh_closed,thresh_warning,thresh_minor,thresh_critical,arg1,arg2,arg3).

situation uV>#3N>0O"!N$:l+GJ1lPJj^;s#

¶ ’situation1’

¶ ’situation2’

¶ ’situation3’

situation_type uVN?$W#

¶ ’situation1’ Nlg"3lO<~ (_) GJ1lPJj^;s#

¶ ’situation2’ Nlg"3lO!N$:l+G9#

v <~ (_)

v ‘Category/Destination’

v ‘Category/Source’

v ‘Destination/Source’

82 P<8gs 3 jj<9 8

¶ ’situation3’ Nlg"3lO!N$:l+G9#

v <~ (_)

v ‘Category’

v ‘Destination’

v ‘Source’

TEC Correlation GO"1lzQd (‘ ’) ,,WG9#

thresh_closed CLOSED 7-$M#

thresh_warning WARNING 7-$M#uVNlYk,3NMr6(kH"Risk Manager O"

$YsHNEgYr WARNING KQ99k+""k$O$YsHrn.7^

9 (,WJlg)#

thresh_minor MINOR 7-$M#uVNlYk,3NMr6(kH"Risk Manager O"$

YsHNEgYr MINOR KQ99k+""k$O$YsHrn.7^9

(,WJlg)#

thresh_critical CRITICAL 7-$M#uVNlYk,3NMr6(kH"Risk Manager O"

$YsHNEgYr CRITICAL KQ99k+""k$O$YsHrn.7^

9 (,WJlg)#

arg1 =13 K"kH</sjAr2H7F/@5$#

= 13. 7-$MH</sNjA

uV ?$W H</s arg1 H</s arg2 H</s arg3

1 _ 6bN+F4j< 6bN8h 6bN=<9

2_

6bN+F4j<^?

O8h

6bN8h^?O=

<9

<~ (_) GJ1lP

JiJ$#

’Category/Destination’ 6bN+F4j< 6bN8h <~ (_) GJ1lP

JiJ$#

’Category/Source’ 6bN+F4j< 6bN=<9 <~ (_) GJ1lP

JiJ$#

’Destination/Source’ 6bN8h 6bN=<9 <~ (_) GJ1lP

JiJ$#

3_

6bN+F4j<"8

h"^?O=<9

<~ (_) GJ1lP

JiJ$#

<~ (_) GJ1lP

JiJ$#

’Category’ 6bN+F4j< <~ (_) GJ1lP

JiJ$#

<~ (_) GJ1lP

JiJ$#

’Destination’ 6bN8h <~ (_) GJ1lP

JiJ$#

<~ (_) GJ1lP

JiJ$#

’Source’ 6bN=<9 <~ (_) GJ1lP

JiJ$#

<~ (_) GJ1lP

JiJ$#



F=.rT$"Q9r-zK9kKO"!NH*j~O7^9#



5.R

iskM

anag

erS

erverC

orrelatio

n

= 14. uVN?$W*hS5k5lkz-t

uV?$W 5k5lkz-t

situation1 situation_type

situation2 arg3

situation2 arg2 *hS arg3

5zJz-tKD$FO"<~ (_) rHQ7J1lPJj^;s#

��9�7��%��

1. !N(sHj<GO"Web X"$YsHH7F,`5lkuV 1 $YsHKD$F"f

S*g-J7-$Mr_j7^9#

set_threshold('situation1',_,5,10,100,500,categ_00001,_,_)

2. !N(sHj<GO"Xj7?[9H (’1.1.111.11’) ,X87?lgK"uV 1 $YsH

,fS*a/=(5l^9#

set_threshold('situation1',_,0.5,5,10,15,_,'1.1.111.11',_).

3. !N(sHj<GO"Xj7?[9H (’1.1.111.11’) ,X87?lgK"uV 2 $YsH

,fS*a/=(5l^9#

set_threshold('situation2','Category/Destination',0.5,5,10,15,_,'1.1.111.11',_).

4. !N(sHj<GO"=<9&[9H (’1.1.111.13’) +iwilkuV 3 $YsHKD$

F"[HsINk,W,J$3HrXj7^9#

set_threshold('situation3','Source',5,100,1000,10000,'1.1.111.13',_,_).

5. !N(sHj<GO"9YFNuV 2 $YsHrsoKa/(9+l<H5;k3HrX

j7^9 (d)5l^;s)#

set_threshold('situation2',_,0.1,1.0,5.0,10.0,_,_,_).

��":+�#��TEC D-GO"k<kO$YsH&-cC7eK]I5lk$YsHK,Q5l^9#-c

C7e,$CQ$KJkH"$YsHO|n5lk+"k<kKhCFh}5lJ/Jj^

9#$YsH&-cC7e,$CQ$KJkH"jXNkLKFAr?(kNG"$YsH&

-cC7eN5$:r!:7F/@5$#

TEC ^?O Risk Manager 5<P<N TEC $YsH&-cC7eN5$:rA'C/9kK

O"!Nh&K~O7^9#

wlsesvrcfg

TEC $YsH&-cC7e&5$:Nd)MO"3000 `\G9#$YsH&-cC7erQ

99kKO"!NH*j~O7^9#

wsetesvrcfg -c 3000

m: $YsH&-cC7e,57/_j5lF$J$H"Risk Manager ,u.fN$YsH

rh}G-kh& TEC 5<P<, -cC7er/j"9klg,"j^9#3Nl

g"Risk Manager ,-cC7er/j"9kH" TEC 5<P<O TEC_Notice $Ys

84 P<8gs 3 jj<9 8

Hr/T7"aC;<8&U#<kIO ″Rule Cache full: forced cleaning.″ K_j5l^

9#/)*K-cC7e,/j"5lkH"{8N Risk Manager uV$YsHGO"!

Nh&KJklg,"j^9#

¶ k<kKhjh},d_7^9#3lO"{8NuV$YsH,Wm;9GHQ9k

IC$YsHru1hiJ$lgK/3j^9#-cC7ebK{8N$YsH,J

/Jk?a":jk<kO$YsHKO,Q5l^;s#

¶ $YsH&j]8Hj<bGE#7^9#uVNU!/H&Y<9GHQ5lkIC

$YsH,5<P<Gu.5lkH"E#,/87^9#3&7?E#O"uV$Y

sHN*j8JkN$s9?s9,-cC7e+i|n5l"k<kKhCFh}5

lJ/Jk?aK/3j^9#*j8JkNuV$YsHO"975l^;s (hN

fur2H)#

Risk Manager Server �� !��J<Nj!Khj"Risk Manager Server N9k<WCH,~e7"F;s5<&$YsHN

h}K,WJ5$/k,:klg,"j^9#

1. riskmrg_baroc.lst U!$kKXj5lF$kTWJ .baroc U!$kr|n7^9#

riskmrg_baroc.lst KO"Risk Manager Khjm<I5lkl"N .baroc U!$k,^

^l^9#?H(P"l0N Netranger "@W?<d ISS RealSecure "@W?<rHQ7

J$lg" sensor_baroc.lst U!$k+iJ<r|n7^9#

netranger.barocrealsecure.baroc

2. $YsHN\je<`,Gb?$"@W?<r">N"@W?<N .baroc U!$kN0

KV-^9#

m: riskmgr.baroc *hS sensor_abstract.baroc U!$kO".baroc U!$k&j9

HNh,KV/,W,"j^9#

?H(P"Web IDS $YsHN\je<`,Gb?/"!K$YsH,?$N, Network

IDS G"klg"riskmgr_baroc.lst U!$kbN(lasHO!Nh&KJj^9#

riskmgr.barocsensor_abstract.barocwebids.barocnids.baroc

3liNU!$kK3$F"$YsHN?$gK=N>N .baroc U!$k,[V5l^

9#

3. riskmgr_categories.pro U!$kbNTWJ+F4j<djvF9F<HasHro|9

k+"3asH=7^9#


5.R

iskM

anag

erS

erverC

orrelatio

n

86 P<8gs 3 jj<9 8

Risk Manager Event Integration Facility

3NOGO"Risk Manager Event Integration Facility (EIF) KD$Fb@7^9#

Risk Manager Event Integration Facility aC;<8KD$FO"268Z<8NXRisk Manager

Event Integration Facility NaC;<8Yr2H7F/@5$# Risk Manager Observer aC

;<8KD$FO"276Z<8NXRisk Manager EIF Observer NaC;<8Yr2H7F/@

5$#

Risk Manager Event Integration Facility ��3NOGO"Risk Manager EIF N$s9H<k"=."*hSI}}!KD$Fb@7^

9#

Risk Manager EIF KO"Risk Manager Tivoli Enterprise Console (TEC) $YsH&5<P<K

$YsHrw.9k?aNH%!=;CH,woCF$^9#3liN!=KO"C Wm0i

`Q API" Perl 9/jWHQN Perl $s?<U'<9"*hS3^sIT!=,"j^

9#

Risk Manager EIF KO"\je<`Ng-$E#^?O`w7?$YsHr"fS*\je

<`N.5$5^j<&$YsHKL.9kWs!=b^^lF$^9#3lKhj"Risk

Manager 5<P<Kw.5lk$YsHN\je<`rL.7"psNm9,"C?H7Fb

=lrG.BKHIa^9#

(sI]$sHK$s9H<k5lF$klg"Risk Manager EIF O;-e" Tivoli

Management Enterprise (TME) $YsHr TEC Server Kw.7^9# TME J0N79F`

K$s9H<k5lF$klg"Risk Manager EIF Os TME $YsHr TEC Server Kw

.7^9#

J<N Risk Manager "@W?<*hS;s5<O"GU)kHG Risk Manager EIF rHQ

7F Risk Manager Server K$YsHr\w9kh&=.5l^9#

¶ Web IDS


¶ Cisco Secure IDS Q"@W?<

Risk Manager EIF O"{8N TEC "Wj1<7gsKhjn.5lk TEC $YsHr$s

?<;WH9kh&"m<+k&Wm-7<H7FHQ9k3HbG-^9#{8N TEC "

Wj1<7gsKO"Tivoli N8`Ns TME TEC "@W?< (TEC SNMP "@W?<J

6


6.R

iskM

anag

erE

vent

Integ

ration

Facility

I)"TEC Unix logfile "@W?<" TEC Windows Event Log "@W?<"*hS TEC

Windows Event Log "@W?< (Windows 2000 *hS Windows NT Q) JI,^^l^

9#

7?,CF"Risk Manager EIF Ws!=O"Risk Manager EIF /i$"sHH1879F`

eK"ks TME TEC "Wj1<7gsGbHQ9k3H,G-^9#Ws5l?$YsH

O";-e" (TME) ^?Os;-e" (s TME) TEC WmH3kKhCF"TEC Server X

>w5l^9#Ws!=O"s TME TEC "@W?<KM89k Risk Manager "@W?<

r5]<H9k3HG"HQD=HJj^9#!N"@W?<,"j^9#

¶ Cisco PIX U!$"&)<kQ"@W?<#3lO"TEC logfile "@W?<*hS$Ys

H&m0&"@W?<KM87^9#

¶ Internet Security Systems RealSecure (ISS RealSecure) Q"@W?<#3lO"TEC SNMP

"@W?<KM87^9#

^17 K"Risk Manager EIF ,FoN=<9+i$YsHrhj~sGWs9kh&9r(7

^9#WsWm;9O"rmad_summary.rules U!$kKjA7?k<kKhCF)f5l^

9#

Risk Manager Event Integration Facility � Tivoli Event IntegrationFacility ��

TEC Event Integration Facility (EIF) O"TEC K$YsHrw.9k3HNG-k"Wj1<

7gsn.QND<k-CH*hSi$Vij<G9#Risk Manager EIF O"Risk Manager

Server ,V+lk TEC Server K$YsHrw.9k?aN"hj-YJ!=rw(F$^

9#

^ 17. Risk Manager Event Integration Facility Nh}

88 P<8gs 3 jj<9 8

TEC Server K$YsHrw.9k?aNJ1J API N>K"Risk Manager EIF O"!N!

=rs!7^9#3lO"Risk Manager "Wj1<7gs*hS5<I&Q<F#<N"W

j1<7gsNIAiGbHQD=G9#

¶ &Qi$Vij<&$s?<U'<9rHQ9k3HKhj""Wj1<7gsO"TEC

$YsH&WmH3k"TME ^?Os TME ("k$O;-e" / s;-e") r'19

k,W,J/Jj^9# Risk Manager EIF O"TME ^?Os TME 79F`NIAi

K$s9H<k5lF$k+K~8F",ZJ TEC $YsH&WmH3kr*r7^

9# TME Hs TME D-QKLNP<8gsN"Wj1<7gsrn.9k,WO"j

^;s#

¶ Risk Manager EIF API O"TjA0N$YsH&9Hjs0ru1~l^9#3N9Hj

s0O"U)<^CH (.fmt) *hS/i9jA9F<HasH (.cds) U!$krHQ7

F"TEC $YsHK^CW9k3H,G-^9#3lO"TEC logfile "@W?<Khj

Tolkh}H`w7F$^9#04KA0=5l?9Hjs0bu1~lD=G9#

¶ Risk Manager EIF KO"$YsHNWs!=,H_~^lF$^9#

¶ Risk Manager EIF O"Perl 9/jWH+iN/0r5]<H7^9#

Risk Manager ObserverRisk Manager Observer ^?O RMO HFPlk Risk Manager EIF Ws(s8sO",%7

?G<bsG9#RMO O$YsHrm<+kGWs7"MCHo</&HiU#C/H TEC

Server K++kiYrZ:7^9#RMO 3^sIKD$FO"90Z<8NXRisk Manager

EIF 3^sIYr2H7F/@5$#

Event Integration Facility ��*�;*�Risk Manager EIF KO"C Wm0i_s0@lGHQ9k$YsH&"Wj1<7gs&W

m0i_s0&$s?<U'<9 (API) i$Vij<,^^lF$^9#Risk Manager EIF

&Qi$Vij<O"Risk Manager "@W?<,$YsH&5<P<K$YsHrw.9k

9k?aK,WJ$s?<U'<9rs!7^9#

Risk Manager EIF rHQ9k Risk Manager s!N"@W?<O"3Ni$Vij<Kjs

/Q_G9#Risk Manager QNH+N"@W?<rn.9klgO"Risk Manager EIF &Q

i$Vij<r,:js/7F/@5$#

3liN API N\YKD$FO"VTivoli Risk Manager GYmCQ<:&,$IWr2H7

F/@5$#

Perl ��Risk Manager KO"Risk Manager EIF HN$s?<U'<9rs!9k Perl b8e<k

rmadpm.pm ,^^lF$^9#Perl b8e<krHQ9kKO"Risk Manager Perl Support

QC1<8r$s9H<k7J1lPJj^;s#Risk Manager EIF Perl b8e<krHQ

9kH"9YFN-zJ Perl 9/jWHrHQ9k3H,G-^9#

Risk Manager EIF Perl b8e<kO" Perl b8e<kQK Comprehensive Perl Archive

Network (CPAN) KhCFx=5lF$k,JK`r7F$^9#CPAN KD$FO"!N

Web 5$Hr2H7F/@5$#

http://www.cpan.org


6.R

iskM

anag

erE

vent

Integ

ration

Facility

��)��"@W?<O"*Zl<7gsN?aK5^6^JU!$krHQ7^9# Risk Manager

EIF ,HQ9kU!$kN?$WO!NH*jG9#

rmad_summary.rulesWsKHQ9kk<krjA7^9#WsNP]HJk/i9&$YsHO"=l>

lKk<k,,WG9#k<kNjAHQ9N\YKD$FO"101Z<8N

Xrmad_summary.rules U!$kYr2H7F/@5$#

U)<^CH&U!$k

"Wj1<7gsN .fmt U!$krHQ9kh& Risk Manager EIF r_j9k3

H,G-^9#TEC logfile "@W?<H1M"Risk Manager EIF O".fmt U!$k

HX"9k .cds U!$krHQ7F"TjA0N$YsH&9Hjs0r,ZJjM

0N TEC $YsHKQ97^9#

CDS U!$kRisk Manager EIF GHQ9kU)<^CH&U!$kO"HQ9k0K .cds U!$

kKQ99k,W,"j^9#Q9rT&KO"riskmgr_gencds 3^sIrHQ7

F/@5$#

=.U!$k

Risk Manager EIF N=.psO"rmad.conf U!$kK-5l^9#=.Qia<?

<N\YKD$FO"94Z<8NXRisk Manager EIF =.U!$k&U)<^CHY

r2H7F/@5$#

Risk Manager EIF '!��Risk Manager Event Integration Facility KO"J<N3HrT&?aN3^sI,^^lF$

^9#

¶ XRisk Manager Observer G<bsNO0Y

¶ 91Z<8NXRisk Manager Observer G<bsNd_Y

¶ 91Z<8NXTEC Server XN$YsHN>wY

¶ 91Z<8NXRisk Manager EIF NI}Y

¶ 91Z<8NXRisk Manager EIF CDS U!$kNn.Y

Risk Manager Observer ��2��

Risk Manager Observer G<bsrO09kKO"!N3^sIrHQ7^9#

UNIX 79F`Nlg:

rmo-init start

Windows 79F`Nlg:

net start rmo

Risk Manager EIF N$s9H<k&Wm0i`O"Risk Manager Observer r+0*KO09

kh&K_j7^9#UNIX 79F`Nlg"Observer O" /etc/inittab (sHj< (AIX)

^?O init.d directories N(sHj< (=N> UNIX WiCHU)<`) rHQ7F+0*K

O09kh&_j5l^9#Windows 79F`Nlg"Risk Manager Observer O+0O05

<S9H7F$s9H<k5l^9#

90 P<8gs 3 jj<9 8

Risk Manager Observer ��2��

Risk Manager Observer G<bsrd_9kKO"!N3^sIrHQ7^9#

UNIX 79F`Nlg:

rmo-init stop

Windows 79F`Nlg:

net stop rmo

9YFN79F`Nlg:

wradmin -kill

TEC Server ��

wrmsendmsg 3^sIKhj"TEC $YsH&5<P<K$YsHr>w7^9#3N3

^sIO"J<N 2 DNA0N$YsH&aC;<8ru1~l^9#

¶ 0->HMNH, 1 D^?O#tH_~^lF$kjM0N9Hjs0#

¶ Risk Manager EIF .cds *hS .fmt U!$krHQ7FU)<^CH9k,WN"km

<&G<?N9Hjs0#

Risk Manager EIF O"$YsHr TEC $YsH&5<P<Kw.9k0K"9Hjs0N

G<?r0-HMNHN;CHKU)<^CH7^9#

0-HMNHN9Hjs0NcrJ<K(7^9#-f Ui0O"9Hjs0,jM0G"j"

9Hjs0NGiNM, TEC $YsH&*V8'/H&/i9>G"k3Hr(7^9#

wrmsendmsg -f "NIDS_DOS;date='12:22:23';rm_SensorIPAddr=11.34.65.99;rm_Timestamp=0x39d8e8ff;rm_DestinationIPAddr=10.0.0.3"

TjM0N9Hjs0NcrJ<K(7^9# Risk Manager EIF .cds U!$kO9Hjs0

r=8rO7"*V8'/HN/i9>rdjvF",ZJ0-KMrdjvFF+i"$Y

sHr TEC Xwj^9#

wrmsendmsg "Oct 3 12:22:23 2000 syslog NIDS foo.tivoli.com0x39d8e8ff 10.0.0.3"

Risk Manager EIF ��

wrmadmin 3^sIKhj"Risk Manager EIF *hS Risk Manager Observer (RMO) r)

f7^9#3N3^sIKO"!N*W7gs,"j^9#

-kill Risk Manager EIF G<bsr*;7^9#"Wj1<7gs,3N*W7gsrFS

P9H"Risk Manager EIF G<bs,+0*KFO07^9#

-info P<8gsKX9kpsr=(7^9#

-restart=.NQ9e"Risk Manager EIF G<bs*hS RMO rd_7FFO07^9#

rmad.conf ^?O rmad_summary.rules U!$krQ97?eO"3N3^sIrB

T9k,W,"j^9#

Risk Manager EIF CDS �)��

riskmgr_gencds 3^sIrHQ7F"U)<^CH&U!$kpsr rmad.cds U!$k

KIC7^9#


6.R

iskM

anag

erE

vent

Integ

ration

Facility

3^sIO"Risk Manager EIF GHQ9k?aN .cds U!$kr8.7^9# Risk

Manager EIF KO"GU)kHN .cds U!$kO^^lF$^;s#.cds U!$kO"

1 D^?O#tN Risk Manager EIF "Wj1<7gs,"TjM0N$YsH&aC;<

8&9Hjs0rHQ9klgK,WG9#

3NlgO",ZJ .fmt U!$krHQ7F",WJ CDS U!$k,n.5l^9#

Risk Manager EIF ��5]<H5lk*Zl<F#s0&79F`XN Risk Manager EIF N$s9H<k}!KD

$FO"33Z<8NXRisk Manager N$s9H<kYr2H7F/@5$#Risk Manager

EIF O"Tivoli (sI]$sH"*hSs Tivoli N<IK$s9H<k9k3H,G-^

9#s Tivoli N<IHO"Tivoli I}j<8gs (TMR) N(sI]$sHH7FjA5l

F$J$/i$"sHN3HG9#

Risk Manager EIF r$s9H<k7?e"!N3HrT$ Risk Manager EIF r=.7^

9#

¶ ,WK~8F rmad.conf =.U!$krT87^9#

?H(P"Risk Manager EIF .cds U!$kNGU)kH>O" rmad.conf U!$kN

AdapterCdsFile Qia<?<rHQ7FQ97F$J$Bj rmad.cds G9#U)<^

CH&U!$kN\,t>O" .cds U!$kN\,t>H18GJ1lPJj^;s (=

l>l rmad.fmt H rmad.cds)#

¶ U)<^CH&U!$krkg7F .cds U!$krF8.7^9#XU)<^CH&U

!$k*hS/i9jA9F<HasH&U!$kN=[Yr2H7F/@5$#

s Tivoli D-GO"Risk Manager =.U!$krj0GT87".fmt *hSX" .cds U!

$krn.9k3H,G-^9# Tivoli D-GO"ACF rHQ7F=.N97r[V9k3

H,G-^9#ACF NHQ}!KD$FO"49Z<8NXACF rHQ7? Risk Manager "

@W?<N=.*hS[[Yr2H7F/@5$#

� �!+��)��*��$��)��J<N9FCWrBT7F" Risk Manager EIF QN7,NU)<^CH&U!$k*hS7

,N .cds U!$krn.7F/@5$#

1. {8N Risk Manager EIF rmad.fmt U)<^CH&U!$k,"klgO"=NU!$k

NemK"Wj1<7gsNU)<^CH&U!$krIC7^9#=lJ0NlgO"

"Wj1<7gs&U)<^CH&U!$kN3T<rn.7F`wN>0 (?H(P"

rmad.fmt02) rU1^9#

2. rmad.fmt U!$kr~OH7F riskmgr_gencds 3^sIrHQ7"77$ .cds U!

$krn.7^9#

riskmgr_gencds rmad.fmt > rmad.cds

Risk Manager EIF .cds U!$kNGU)kH>O"rmad.conf U!$kN AdapterCdsFileQia<?<rHQ7FQ97F$J$Bj rmad.cds G9#U)<^CH&U!$kN\,

t>O".cds U!$kN\,t>H18GJ1lPJj^;s (=l>l rmad.fmt H

rmad.cds)#

92 P<8gs 3 jj<9 8

3liNU!$kO>}"GU)kHG $RMADHOME¥RISKMGR¥adapters¥etc G#l/Hj<K

"j^9#

Perl ��Risk Manager EIF KO"Perl 9/jWHKhj$YsHr Risk Manager TEC Server Kw.

9k?aN$s?<U'<9,s!5lF$^9# Perl 9/jWH+i Risk Manager EIF

K"/;99kKO" Risk Manager Perl 5]<HN$s9H<kbT$"Risk Manager Perl

G#9HjSe<7gsrHQ7F9/jWHrBT7^9#

Risk Manager GO"UNIX *hS Windows 79F`K*1k Perl r5]<H7^9#

TME ��"� TME �� Risk Manager EIF ��Risk Manager EIF O"TME ^?Os TME D-NIAiGBT9k+KhCF"[JkP<

8gsN Risk Manager EIF G<bsrHQ7^9#Risk Manager O"UNIX 79F`G

rmeif_cfg 3^sIrHQ7F"Risk Manager r TME ^?Os TME D-GBT9kh&

=.rT$^9#

$s9H<k&Wm;9K*$F"TME (sI]$sHQND-9/jWH lcf_env.sh ,

!P5l?lg"3lO TME D-rHQ7^9##tN lcf_env.sh U!$k,!P5l?

lg"GeK!P5l?U!$k,HQ5l^9#$s9H<k~K_j5l?GU)kH=

.rQ99kKO"rmeif_cfg 3^sIrHQ7^9#

TME ^?Os TME D-N$:lNlgGb Risk Manager EIF rBT9kh&=.9kK

O" rmeif_cfg 3^sIrHQ7^9#3^sIN=8O!NH*jG9#

rmeif_cfg { -n | -t [ -d directory ] }

-n s TME D-rXj7^9#

-t TME D-rXj7^9#

-d directory

TME (sI]$sHN lcf_env.sh D-9/jWH,V+lF$kG#l/Hj<

rXj7^9#

*;~"0 O5o*;r"0 hjg-JMO(i<r(7^9#

-n *W7gsrHQ7F"s TME D-GBT9kh& Risk Manager EIF r=.7^9#

3NUi0Khj"$RMADHOME/bin/rmad_cad 7s\jC/&js/,

$RMADHOME/bin/nontme/rmad_cad (s TME P<8gsN Risk Manager EIF G<bs) rX9

h&Q97^9#Risk Manager D-9/jWH /etc/Tivoli/rma_eif_env.sh GO" TME

(sI]$sHND-9/jWHN=<9T,o|5l^9#

-t *W7gsrHQ7F"TME D-GBT9kh& Risk Manager EIF r=.7^9#3N

Ui0Khj"$RMADHOME/bin/rmad_cad 7s\jC/&js/,

$RMADHOME/bin/tme/rmad_cad (TME P<8gsN Risk Manager EIF G<bs) rX9h&Q

97^9#Risk Manager D-9/jWH /etc/Tivoli/rma_eif_env.sh GO" TME (sI

]$sHND-9/jWHN=<9T,IC5l^9#


6.R

iskM

anag

erE

vent

Integ

ration

Facility

*W7gsN -d directory Ui0r -t Ui0HloKHQ9kH" rmeif_cfg 3^sIO"directory/lcf_env.sh U!$k,8_9klg"3lr TME (sI]$sHND-9

/jWHH7FHQ7^9# -d Ui0r -t HloKHQ7J$lg" rmeif_cfg 3^sIO /etc/Tivoli/lcf G#l/Hj<N9YFN5VG#l/Hj<+i lcf_env.sh U!$

kr!w7^9##tN lcf_env.sh U!$k,!P5l?lg"GeK!P5l?U!$k

, TME (sI]$sHND-9/jWHH7FHQ5l^9,"3lO=N TME (sI

]$sHQN57$D-9/jWHGJ$lg,"j^9#

m: J0N(sI]$sHN$s9H<kr57//j<s"CW;:K(sI]$sHrF

$s9H<k9kH"#tN lcf_env.sh D-9/jWH,8_9klg,"j^9#7

9F`K#tN lcf_env.sh U!$k,"k (/etc/Tivoli/lcf J<KVfU-N#tN

G#l/Hj<,8_9k) lg" -d Ui0r -t HloKHQ7F"HQ9k TME

(sI]$sHQN,ZJD-9/jWH, Risk Manager 9/jWH

(/etc/Tivoli/rma_eif_env.sh) N=<9HJkh&K9k,W,"j^9#

Risk Manager Event Integration Facility N=.r0;9kKO"rmad.conf U!$kr=.9

k,W,"j^9# rmad.conf U!$kN=.KD$FO"XRisk Manager EIF =.U!$

kYr2H7F/@5$#

rmeif_cfg '!��!K rmeif_cfg 3^sINcr(7^9#

1. s TME D-GHQ9kh& Risk Manager EIF r=.9kKO"!Nh&K~O7^

9#

rmeif_cfg -n

2. TME (sI]$sHGHQ9kh& Risk Manager EIF r=.9kKO"!Nh&K~O

7^9#

rmeif_cfg -t -d /etc/Tivoli/lcf/1

3NcGO"lcf_env.sh 9/jWHO /etc/Tivoli/lcf/1 G#l/Hj<K"j^9#

Risk Manager EIF ��)��Risk Manager EIF O"=.*W7gs*hS$YsH&U#k?<Nj]8Hj<H7F

rmad.conf U!$krHQ7^9#3NU!$kO"Risk Manager EIF G<bsN+O~K

I_hil^9#3NU!$krQ99k3HKhCF" Risk Manager EIF r$DGbF=

.9k3H,G-^9#=.Q9r-zK9kKO"Risk Manager Event Integration Facility

rd_7FFO07^9#

rmad.conf U!$kO"!NG#l/Hj<K"j^9#

$RMADHOME/etc

Installation_dir O"Risk Manager EIF N$s9H<kljG9#

Risk Manager EIF ��)�� !+3asHTO]sI-f (#) GO^j^9#Vis/TrHQ9k3H,G-^9#95Z<8

NX=.U!$kNcYKcr(7^9#

¶ =.*W7gsrXj9kKO"!Nh&K7^9#

keyword=value

94 P<8gs 3 jj<9 8

¶ $YsH&PCU!<Kw.7J$ $YsHN$YsH&U#k?<rXj9kKO"!

Nh&K7^9#

Filter:CLASS=class_name;attribute=value;

m: attribute=value O"J0O slot =value G7?#

¶ $YsH&PCU!<Kw.7J$ $YsHNPCU!<&U#k?<rXj9kKO"

!Nh&K7^9#

FilterCache:CLASS=class_name;attribute=value;

��)��

## Communication Parameters#ServerLocation=ravelServerPort=5529EventMaxSize=4096ConnectionMode=CO# Event Filters#Filter:Class=disk_eventFilter:Class=su_login; origin=126.32.2.14

rmad.conf ��)��"�4��-<o<IO"keyword=value H$&A0G9#

zQdGO^J$Bj"-<o<I&9F<HasHGVis/rHQ7FOJj^;

s#.baroc U!$kKjA5lF$J$/i9>r=.*W7gsHloKHQ7FOJj

^;s#-<o<IN9ZkrVc(?j"-<o<Ir5zJMK_j7Fb"(i<&a

C;<8O/T5l^;s#

Risk Manager EIF rmad.conf =.U!$kKO"J<N-<o<I,^^lF$^9#3l

iN-<o<IO"[HsIN"@W?<K&LG"j"F`\OL9NTK"j^9#

AdapterCdsFile=Path

.cds U!$kNdPQ9>rXj7^9#3N-<o<IO".cds U!$k,=.U

!$kH18G#l/Hj<KJ$lgO,\G9#

AdapterErrorFile=Path

(i<&U!$kNdPQ9>rXj7^9#3N-<o<IO"(i<&U!$k

,=.U!$kH18G#l/Hj<KJ$lgO,\G9#

AdapterSpecificFile=Path

"@W?<G-N=.U!$kNdPQ9>rXj7^9#3N-<o<IO""@

W?<G-NU!$k,=.U!$kH18G#l/Hj<KJ$lgO,\G9#

AdapterTimeOutRisk Manager Event Integration Facility G<bsN?$`"&HrC1LGXj7^

9 (UNIX Nlg)#

BufEvtMaxSize$YsH&"@W?<NPCU!<&U!$kNGg5$:r K P$H1LGXj

7^9#GU)kHMO 64 G9#

BufEvtMaxSize -<o<IO*W7gJkG9#


6.R

iskM

anag

erE

vent

Integ

ration

Facility

BufEvtPath$YsH&"@W?<NPCU!<&U!$kNdPQ9>rXj7^9#UNIX 7

9F`NGU)kHO"/etc/Tivoli/tec/cache G9#Windows 79F`NGU)k

HO cache.dat G9#

BufEvtPath -<o<IO*W7gJkG9#

BufEvtRdblkLenI_hk$YsH&"@W?<&PCU!<&U!$k&VmC/N5$:r K P

$H1LGXj7^9#3N5$:O"/J/Hb 1 DN$YsHK=,K-jkg

-5GJ1lPJj^;s#GU)kHMO 64 G9#

BufEvtRdblkLen -<o<IO*W7gJkG9#

BufEvtShrinkBlk"@W?<NPCU!<&U!$krL.9k]"G<?N3T<fKHQ9kVm

C/&5$:r K P$H1LGXj7^9#

BufEvtShrinkBlk -<o<IO*W7gJkG9#

BufEvtShrinkSizeBufEvtMaxSize r6a7?H-K"$YsH&"@W?<NPCU!<&U!$k

rL.9kLr K P$H1LGXj7^9#GU)kHMO 8 G9#

BufEvtShrinkSize -<o<IO*W7gJkG9#

BufferEvents$YsH&PCU!js0rHQD=K9k+I&+rXj7^9#GU)kHMO

YES G9# BufferEvents r YES J0K_j9kH"$YsHOPCU!<K~

lil^;s#3NMKOg8z.8zNhLO"j^;s#

BufferEvents -<o<IO*W7gJkG9#

BufferFlushRate,v?jKw.5lk$YsHNtrXj7^9#ZG5l?\3,"@W?<Kh

CFs|5l"PCU!<bK$YsH,"klgO"$YsHO,"?j3N.Y

GP<9H1LGw.5l^9#GU)kHMO 0 G"$YsHO 1 DNP<9H

1LGw.5l^9#

BufferFlushRate -<o<IO*W7gJkG9#

BuffersEventsLimit=Limit

$YsH&5<P<,@&s7?lgK"PCU!<K~lilk$YsHNGgt

rXj7^9#GU)kHO5)B (Limit KM,Xj5lF$J$) G9#3lO"

PCU!<K~lilk$YsHNGgtO"abj<LN)B7+u1J$H$&

XjG9#3Nabj<B&r6a9kH"G7N$YsHr~lk?aK-e<N

fNGbE$$YsH,Q~5l^9#

ConnectionMode$YsH&5<P<K\39k?aKHQ9k\3b<IrXj7^9#-zJMO

!NH*jG9#

connection_oriented\3,"@W?<i|=~KN)5l"w.5lk$YsHN?aK]}5l

^9#7,N\3O"i|\3,:ol?lgKN_N)5l^9#\3O"

"@W?<,*;9kHQ~5l^9#

96 P<8gs 3 jj<9 8

gLN"i<`r8.9k"@W?<GHQ9klgO"

connection_oriented"CO"^?O co b<IKhj9k<WCHNz(=

r^k3H,G-^9#

connection_lessw.5lk$YsH4HK7,N\3,N)5l (!$GQ~5l) ^9#3

l,GU)kHMG9#

ConnectionMode -<o<IO*W7gJkG9#

EnableTraceRisk Manager Observer KhjHQ5l^9#3NMr YES K9kH"Observer K

hkHl<9rD=K7^9#GU)kHO NO G9#EnableTrace=YES Nlg"G

<?O TraceFile Qia<?<,_j5lF$lP"=NXjU!$kKq-~^l

^9#_j5lF$J$lg"G<?O8`POKq-~^l^9#

EventMaxSize$YsHNGg9rXj7^9#GU)kHMO 4096 G9#

EventMaxSize -<o<IO*W7gJkG9#

Filter $YsHNU#k?<}!rXj7^9# Filter 9F<HasHO"$YsH&5<

P<Kw.9k$YsHdQ~9k$YsHrhj9k]K" FilterMode KhCFHQ5l^9#$YsH, Filter 9F<HasHHlW9kNO" Filter 9F<H

asHNF attribute=value NH,"$YsHNP~9k attribute=value NHHy7$

lgG9# Filter 9F<HasHKO"$YsH&/i9,~CF$J1lPJi

:"=N$YsH&/i9KjA5lF$k>N9YFN attribute=value HrH_~

`3HbG-^9# Filter 9F<HasHNA0O"!NH*jG9#

Filter:Class=class_name;attribute=value;...;attribute=value

F Filter 9F<HasHO" 512 8z (Gg) N1lNTGJ1lPJj^;s#

Filter -<o<IO*W7gJkG9#U#k?<rXj7J$lgO"$YsHO

$YsH&5<P<Kw.5l^9#

FilterCachePCU!<K~CF$k$YsHNU#k?<}!rXj7^9#$YsHr5oK

$YsH&5<P<Kw.G-J$lgK" BufferEvents=yes rXj7F"k+"

GU)kHG3NXjKJCF$kH"$YsHO-cC7eK~lil^9#$Y

sH, FilterCache 9F<HasHHlW9kNO" FilterCache 9F<HasH

NF attribute=value NH,"P~9k$YsHN attribute=value NHHy7$lgG

9# FilterCache 9F<HasHKO"$YsH&/i9,~CF$J1lPJi

:"=N$YsH&/i9KjA5lF$k>N9YFN attribute=value NHrH_

~`3HbG-^9# FilterCache 9F<HasHNA0O"!NH*jG9#

FilterCache:Class=class name;attribute=value;...;attribute=value

F FilterCache 9F<HasHO" 512 8z (Gg) N1lNTGJ1lPJj^

;s#

FilterCache -<o<IO*W7gJkG9#PCU!<&U#k?<rXj7J$

lgO"$YsHOPCU!<K~lil^9#


6.R

iskM

anag

erE

vent

Integ

ration

Facility

FilterModeFilter ^?O FilterCache 9F<HasHHlW9k$YsHr"w.9k

(FilterMode=IN) N+"|n9k (FilterMode=OUT) N+rXj7^9#GU)kH

MO OUT G9#

FilterMode -<o<IO*W7gJkG9# FilterMode rXj7F$J$lg

O" Filter ^?O FilterCache 9F<HasHN$:lHblW7J$$YsH@

1,"$YsH&5<P<Kw.5l^9#

m: FilterMode=IN r_j9klgO",:"Filter ^?O FilterCache 9F<Ha

sHr 1 D^?O#tjA7F*$F/@5$#3N9F<HasHrjA7F

$J$lg"$YsH&5<P<O"@W?<+i$YsHru.7^;s#

LocalEventPortRisk Manager Observer KhjHQ5l^9#Observer ,$YsHNu.KHQ9k

=1CHrjA7^9#GU)kHN]<HVfO 5529 G9#GU)kHN

LocalEventPort rQ97F+i Risk Manager EIF r+O9k,W,88klg,

"j^9#Risk Manager EIF NO0~KP$sIc0,/89klgO"

LocalEventPort rHQD=J]<HKQ97FFO07F/@5$#

m: RMO r Windows NT Server GBT9klgO" TEC 5<P<N]<HVfH

OLN]<HVfr*r7F/@5$#

LocalEventProcessingRisk Manager Observer KhjHQ5l^9#LocalEventProcessing=YES H_j9

k3HKhj" Risk Manager EIF "Wj1<7gsKD$F$YsHNWs,To

l^9#Risk Manager EIF "Wj1<7gsO"rmad_send_message API rHQ

9k"Wj1<7gsG9#3lKO"Check Point FireWall-1 d Cisco Secure IDS

"@W?<JIN"Wj1<7gs,"j"=Nk<kO rmad_summary.rules Kj

A5l^9#Ws (^?O8s) 5l?$YsHO"TEC Server Xw.5l^9#

LocalEventProcessing=NO Nlg"9YFND9N$YsH, TEC Server K>\

w.5l^9#^?"Risk Manager EIF rHQ9k"@W?<^?O;s5<KWs

k<k,J$lgKb" LocalEventProcessing=NO r_j9k3H,G-^9#

?H(P"Web IDS KOWsk<kO"j^;s#3Nlg"Web IDS , Risk

Manager EIF rHQ9k#lN"Wj1<7gsG"klgO"

LocalEventProcessing=NO r_j9k3H,G-^9#

RetryIntervalConnectionMode=connection_oriented rXj7F"klgG"$YsH&5<P

<XN\3,:olkH""@W?<OXj7?CtT!7?eG"2 !5<P<K

\37?j"$YsHrPCU!<K~l?j7^9#3N|V,~;9kNr"@

W?<,T!7F$kVO""@W?<O7,$YsHrh}7^;s#

3N*W7gsrXj9kH""@W?<O"1 !$YsH&5<P<,;|Vd_

7F$Fb"$YsHr 1 !$YsH&5<P<Kw.G-^9#3lKhCF"7

,Nk<k&Y<9rm<I9kH-JIO"5<P<,W.KFO09kh&KJ

j^9#

3N*W7gsrHQ7F$YsH&5<P<NFO0rT!9kh&K9klg

O"$YsH&5<P<,d_7FFO09kNK,WJ~Vhjb9$~VrMK

_j9k,W,"j^9#

98 P<8gs 3 jj<9 8

GU)kHO 120 CG9#

RetryInterval -<o<IO*W7gJkG9#

RmadLoggingRisk Manager EIF G<bsBTm.s0rHQD=K7^9#RmadLogging=YES^?O RmadLogging=Yes K_j7F"Risk Manager EIF Nh}rHl<97F

rmad.log U!$kK-?7^9#

Rmo_AcceptNonLocalEventsYES rXj9kH"Risk Manager Observer G<bsOjb<H&"Wj1<7gs

+iN\3ru1~l^9#GU)kHO NO G9#m<+kJ0N"Wj1<7g

s+iN\3ru1~l?lgK"Risk Manager EIF , TME ;-ejF#<rHQ

7F$YsHr TEC Kw.9kh&=.5lF$kH"!)3l,/-k?aG

9#

Rmo_EnableTraceRisk Manager Observer G<bsKhkHl<9rHQD=K9kKO"

Rmo_EnableTrace=YES r_j7^9#

Rmo_TraceFileRmo_EnableTrace=YES Nlg"3NQia<?<r_j7F"Hl<9&G<?

rq-~`U!$kr_j7^9# Rmo_TraceFile ,Xj5lF$J$lg"G<

?O8`POKq-~^l^9#

Rmo_WorkingDirRisk Manager Observer NnHG#l/Hj<rXj7^9#GU)kHGO"Risk

Manager Observer O!NG#l/Hj<rJ3*9Hl<8NnHG#l/Hj<H

7FHQ7^9# /var/RISKMGR (UNIX 79F`Nlg) *hS %TEMP% (Windows

79F`Nlg)

ServerLocation$YsH&5<P<r$s9H<k9k[9HN>0rXj7^9#3NU#<kI

NMO"J<N$:l+NA0GJ1lPJj^;s#3lO"Risk Manager EIF G

<bs,I3K$s9H<k5lk+"$YsH&"@W?<,;-e"G"k+s

;-e"G"k+"$YsH&5<P<, Tivoli I}j<8gs (TMR) NltG"

k+I&+KhCF[Jj^9#

lj A0

TME @EventServer

j_\35lF$k TMR N TME @EventServer#RegionName

s TME"s;-e" host name ^?O IP_address

IP_address KO"ICHA0rHQ7^9#

s TME "@W?<Nlg" ServerLocation KO"3s^GhZC?Mr 8 D^

G~lk3H,G-^9#GiNljO 1 !$YsH&5<P<G"2 V\J_Nl

jO 1 !5<P<,@&s7F$kH-KHQ9k 2 !5<P<G9#

TME "@W?<G"k(sI]$sH&"@W?<Nlg"ServerLocation ,Xj

G-kNO 1 !$YsH&5<P<@1G9#TEC 2<H&'$=.U!$kKe

X 2 !$YsH&5<P<rXj7^9#


6.R

iskM

anag

erE

vent

Integ

ration

Facility

ServerLocation -<o<IO,\G9#

m: ServerLocation O"TestMode -<o<IHloKHQ9kH"$YsH&5

<P<GOJ/"$YsHrm0K-?9k?aNU!$kNQ9*hS>0r

jA7^9#

ServerPort$YsH&5<P<,$YsHr listen 9k]<HVfrXj7^9#3N-<o<

IMO"]<H^CQ<,$YsH&5<P<eGHQTDKJCF$J$Bj"

0 (GU)kHM) K_j7F/@5$#]<HVfr 0 H7FXj9k+]<HV

frXj7J$lg"]<HVfO]<H^CQ<rHQ7F!w5l^9#

ServerPort KO"3s^GhZC?Mr 8 D^G~lk3H,G-^9#Xj5l

? ServerLocation MNtHOX8J/"1 DN]<HVfrXj7^9##tN]

<HVfrXj9klgO"ServerLocation M4HKP~9k]<HVfrXj7

J1lPJj^;s#

GU)kHO 0 G9#

ServerPort -<o<IO"$YsH&5<P<, UNIX 79F`eGT/7F$k

lgO*W7gJkG9,"Windows 79F`eGT/7F$klgO,\G9#

m: "@W?<,BT~Ku.]<HrHqG-kh&K9k]<H^CQ<&G<

bsO"Windows NT ^7seK8_7^;s#\3*hS"@W?<~OrT

&?aK"$YsH&5<P<,"Gju.]<H (.tec_config Ntec_recv_agent_port) r listen 7^9# $BINDIR/TME/TEC U!$kN

.tec_config G#l/Hj<N ServerPort r tec_recv_agent_port `\NMK

_j7F/@5$#

TestModeF9H&b<Ir*sK9k+*UK9k+rXj7^9#TestMode=Yes rXj9

kH"ServerLocation -<o<IO"$YsH&5<P<K_j5lkNGOJ

/"$YsHrm0K-?9kU!$krXj7^9#-zMO Yes H No G9(g8z.8zNhLO"j^;s)#GU)kHMO No G9#

TestMode -<o<IO*W7gJkG9#

��Lo"Risk Manager EIF O"$YsHr$YsH&5<P<Kw.7^9#*W7gsG"

$YsH,$YsH&5<P<Kw.5lkh&""k$Ow.5lJ$h&Xj9k3Hb

G-^9#3lO"?WkrH_~sG$YsHrU#k?<9k3HKhCFT&3H,G

-^9#?Wk KO"$YsH&/i9d"/@"EgY"^?O$YsH&/i9KjA

5lF$k=N>N attribute=value NHJINps,H_~^lF$^9#

F$YsH&U#k?<`\O"rmad.conf =.U!$kfN"512 8z (Gg) NL9NT

KXj7F/@5$#=.U!$kKO"$YsH&U#k?<`\r,WJt@1~lk3

H,G-^9#$YsH&U#k?<`\KXj9k/i9>O"jAQ_N/i9>HlW

7F$J1lPJj^;s#

$YsH&U#k?<`\NA0O"!NH*jG9#

Filter:Class=ClassName;attribute=value;...;attribute=value

100 P<8gs 3 jj<9 8

D-Qt FilterMode rHQ7F"Risk Manager EIF NU#k?<`nrQ99k3H,G

-^9#GU)kHGO"FilterMode O OUT K_j5lF$^9#FilterMode=IN r=.

U!$kKIC9kH"U#k?<HlW9k$YsH@1,$YsH&5<P<Kw#5l

^9#U#k?<`nN\YKD$FO"VTivoli Enterprise Console "@W?<&,$IW

r2H7F/@5$#

��+�)��Risk Manager EIF ,$YsH&5<P<^?O TEC 2<H&'$K\3G-J$lgK"

$YsH&PCU!js0,HQD=KJCF$kH"$YsHO Risk Manager EIF PCU

!<&U!$kKw.5l^9#$YsH&PCU!js0rHQD=K9kKO"=.U!

$kNfG BufferEvents=yes r_j7^9#PCU!<&U!$kO"BufEvtPath -<

o<IrHQ7FjA7^9#

$YsH&5<P<Kw.9k$YsHNU#k?<h}H1MK"PCU!<&U!$kK

w.9k$YsHNU#k?<h}rT&3H,G-^9#F$YsH&PCU!<&U#k

?<`\O""@W?<=.U!$kNL9NTKJ1lPJj^;s#=.U!$kKO"

$YsH&PCU!<&U#k?<`\r,WJt@1~lk3H,G-^9#"k$Ys

H&PCU!<&U#k?<`\KXj9k/i9>O"jAQ_N/i9>HlW7F$J

1lPJj^;s#

GU)kHN$YsH&PCU!<&U#k?<O"j^;s#

$YsH&PCU!<&U#k?<`\NA0O"!NH*jG9#

FilterCache:Class=ClassName;attribute=value;...;attribute=value

rmad_summary.rules �)��rmad_summary.rules U!$krHQ7F"U#k?<*hS$YsH8srXj9k3H,

G-^9#

Ws!=rI}9kk<kO"rmad_summary.rules U!$kKjA5lF$^9#Fk<k

O"!NbFrXj7^9#

¶ Ws9k$YsH&/i9N>0#

¶ Xj5l?k<kKlW9k$YsHNpsr}89k~VVV#

¶ Xj7?$YsH&/i9KD$F$YsHNMKlW9k,WN"kMr}D0-N>

0#

¶ $YsHKlW7J$0-rV-9(kM#3liNMO"F5^j<&$YsH4HK

Q(k3H,G-^9#

?H(Pk<kO"!Nps+in.9k3H,G-^9#

FW_connection_denied$YsHN/i9>r1L7^9#

FW_source_IPAddr$YsHNMKlW7J1lPJiJ$=<9 IP "Il9rXj7^9#

FW_destination_IPAddr$YsHNMKlW7J1lPJiJ$8h IP "Il9rXj7^9#


6.R

iskM

anag

erE

vent

Integ

ration

Facility

30000 $YsH, TEC K>w5lk0K"k<kKlW9kIC$YsHrTD~V (_

jC) r=7^9#

Set FW_source_port = *5^j<&$YsHGHQ5lk=<9&]<HQNV9MrXj7^9#

Set FW_dest_port = *5^j<&$YsHGHQ5lk8h]<HQNV9MrXj7^9#

Set msg=″Summarized port scan″5^j<&$YsHGHQ5lk msg 0-NV9MrXj7^9#

3NWs!=O"QKK/89k FW_connection_denied $YsHN;CHr!P7^

9#3liN$YsHO"CjN[9HKP9k]<H&9-csr=7^9#

FW_connection_denied /i9N$YsH, Risk Manager EIF KhCFu.5lkH"k

<k,1L5l"5^j<&$YsH,n.5l"?$^<,+O7^9#5^j<&$Ys

HK>N$YsH ($YsH&/i9>*hS0-M) ,lW9k0K?$^<N-z|B,

Zl?lgO"1lN$YsH, TEC Kwil^9#?@7"#tN$YsH,180-/

i9>H0-Mr}Dlg"$YsHO1lN5^j<&$YsHH7F TEC Kwil^

9#

=NeN 30 CJbK"k<kK>$>N FW_connection_denied $YsH,}85l^

9#33G"FW_source_IPAddr *hS FW_destination_IPAddr 0-O"*j8JkNH

j,<&$YsHH18G"k,W,"j^9# Risk Manager EIF O"repeat_count MK

lW7F3lr}C5;k$YsHr9YFQ~7^9# 30 CeK?$^<N-z|B,Z

lkH" EIF O5^j<&$YsHr=.7F"3lr TEC Xw.7^9#5^j<&$

YsHO"*j8JkNX"$YsHH18/i9>r}A^9# FW_source_port"FW_dest_port"*hS msg 0-NV9MrH_~s@lg"5^j<&$YsHK3li

NM,^^l^9#

m: repeat_count /i9KO"5^j<&$YsHKhCF=5lkD9N$YsHNt,

^^l^9#3N/i9O"TEC Server K>w5lk5^j<&$YsHK^^l^

9#

��!K"FW_connection_denied /i9rHQ7?cr(7^9#3NcGO"Risk Manager

EIF O"FW_connection_denied /i9KD$F 30 CJbKD9N$YsHr 10 D8a

^9#

m: 3NcGO 30 CrXj7F$^9,"_jC1LG$UN?$^<_j,D=G9#

3NcGO"Risk Manager EIF O5^j<&$YsHr 3 D]}7F$^9#3lO"$Y

sH&/i9"=<9 IP "Il9"*hS8h IP "Il9K 3 H*jNG-NH_go

;,8_9k?aG9#$YsHN&A 2 D,CjNp`KlW9k?a"3l,5^j

<&$YsHHJj^9# 3 D\N$YsHOCjNp`KlW7J$?a"EIF Ou.5

l?^^NuVG TEC Kwil^9#

103Z<8N=15 O"Risk Manager EIF Khju.5l?$YsHNC-r(7^9#=f

N0-N>"msg 0-O"9-csNP]H5l?8h]<Hr=7F$^9#33K(9

9YFN$YsHN$YsH&/i9O"FW_connection_denied G9#

102 P<8gs 3 jj<9 8

= 15. ;s5<KhCFu.5lk*j8JkN$YsH. =fN0-N>"3NcN msg0-O"$YsH,5^j<&$YsHG"k3Hr(5J1lPJj^;s#33K(9

9YFN$YsHN$YsH&/i9O"FW_connection_denied G9#

5^j<&$YsH =<9 IP "Il9 8h IP "Il9 =<9&

]<H

8h]<H

1 23.56.78.99 32.11.22.33 5432 389

2 44.55.66.77 66.77.88.99 6000 1000

1 23.56.78.99 32.11.22.33 5432 389

2 44.55.66.77 66.77.77.88 6000 1001

2 44.55.66.77 66.77.77.88 6000 1002

1 23.56.78.99 32.11.22.33 5432 389

3 11.11.11.11 22.22.22.22 10000 9999

1 23.56.78.99 32.11.22.33 5432 389

2 44.55.66.77 66.77.77.88 6000 1001

2 44.55.66.77 66.77.77.88 6000 1002

=16 O"Risk Manager EIF Khj>w5l?$YsHNC-r(7^9#

= 16. Ws!=Khjh}5l?$YsH. =fN0-N>"msg 0-O"9-csNP]

H5l?8h]<Hr=7F$^9#33K(99YFN$YsHN$YsH&/i9O"

FW_connection_denied G9#

5^j<&

$YsH ID=<9 IP"Il9

8h IP"Il9

=<9&

]<H

8h]<H repeat_count

Ws 1 23.56.78.99 32.11.22.33 ″*″ ″*″ 3

Ws 2 44.55.66.77 66.77.88.99 ″*″ ″*″ 4

*j8Jk 3 11.11.11.11 22.22.22.22 10000 9999 0

m: repeat_count 0-O"<mJ0NMr}A"5^j<&$YsHKhj=5lk*j8

Jk&$YsHNtr=7^9# repeat_count NMO"B]O"Ws$YsHNthj

1 D.5$MHJj^9#?H(P"10 DN$YsH,Ws5l?lg"repeat_countMO 9 K_j5lF$^9#$YsH,Ws5lJ$lg"repeat_count MN_jO<

mG9#

��J<NcGO"rmad_summary.rules U!$kK77$Wsk<krn.9k?aNFsWl

<Hr(7^9#

Fk<kKO"5 o`N(lasH,^^lF$^9#cNfG"F(lasHNk<kbG

NLVr,+jd9/9k?a"5 DN(lasHKOVf,U1ilF$^9#

1. 3N(lasHO"k<kNG-iYkG9#3NiYkO"b@QNlgH9k3H,

G-^9,"9Z<9r^`3HOG-^;s#3NcGO"HQ5lkiYkO

PIX_Portscan_In G"j"$sP&sIN]<H&9-csr=7^9#

2. 3N(lasHO"Ws9k$YsHN/i9>G9#3NcGO"/i9>O

PIX_TCP_in_conn_denied G9#

3. PIX_TCP_in_conn_denied /i9K^^lk0-G9#e.$YsHrWs$YsHH9k

KO"=NM,3N0-NMKlW7J1lPJj^;s#3NcKO"lW9k0-,

6 D"j^9 (pix_sev"pix_code"pix_ifname" rm_SourceIPAddr"rm_DestinationIPAddr"*hS rm_SensorIPAddr)#


6.R

iskM

anag

erE

vent

Integ

ration

Facility

4. _jCG_j5l??$`"&HMN;CHG9#3NcK*1k_jO"30000 _jC

G9#

5. 3lO SET G#l/F#VG9#3lKhj"WsKOHQ5lJ$0-NV9Mrj

A7^9#V9M,"msg 0-KP7FXj5l"3l,n.5lk$YsH,Ws$Y

sHG"k3Hr(9ICN$sG#1<?<HJj^9#0-KdjvFkV98zK

9Z<9r^`3HOG-^;s#

!NcO"5 DN(lasH&?$Wr}g7F$^9#

(PIX_PortScan_In # Element 1{PIX_TCP_in_conn_denied} # Element 2[cloneableattributeSet=&pix_sev, # Element 3

&pix_code,&pix_ifname,&rm_SourceIPAddr,&rm_DestinationIPAddr,&rm_SensorIPAddr

]statemachine.collector 30000 # Element 4(true

)!(SummarySET:rm_SrcPort=*,rm_DstPort=*,

msg=SUMMARY_Multiple_TCPIP_Inbound_connections_denied_by_Cisco_PIX_firewall # Element 5);

m: 3N=8GO"gL ( )"ggL [ ]"*hSfgL { } KhkXjN+W;k=rHQ

9k,W,"j^9# SET G#l/F#VK3/9Hjs0GO"9Z<9rHQ9k

3HOG-^;s#V9MrXj9k,W,J$lgO"SET G#l/F#VHMrJ,

9k3H,G-^9#!NcO"SET G#l/F#VrHQ7J$=8r(7^9#

(PIX_Generic_Minor_Evt{PIX_Generic_Minor}[cloneableattributeSet=&rm_SensorIPAddr,

&pixm_code,&msg

]statemachine.collector 30000(

true)

)!Summary);

<=+��A'C/&k<k (Windows N checkrules.cmd) 9/jWHrHQ9k3HKhj"k<

k&U!$kN=8rA'C/9k3H,G-^9#GU)kHGO"9/jWHO

$RMADHOME/etc/rmad_summary.rules U!$krA'C/7^9#9/jWHKU!$kN0

4$~>rwj">NU!$kbNk<kN=8rA'C/9k3H,G-^9#

m: A'C/&k<k&9/jWHO"k<kN=8N_rA'C/7^9#0-;CH&j

9H^?O SET:attr=value 9F<HasHbN0-,"$YsHN .baroc U!$kK

jA5lF$k0-HlW9k+I&+KD$FOA'C/5l^;s#$YsH0->

,"baroc U!$kK_j5l?MH,:lW9kh&K7F/@5$#lW7J$l

g"WsNkL,6io7/Jj"$YsH&5<P<G$YsHNrO(i<,/89

104 P<8gs 3 jj<9 8

klg,"j^9# Risk Manager Ks!5lk$YsHNWsk<krIC^?OQ9

9klg" baroc U!$k, Risk Manager Server N $BINDIR/RISKMGR/corr/tec G#l

/Hj<K$s9H<k5l^9#

#�� Risk Manager EIF �)��Risk Manager Event Integration Facility O"!NU!$kHN$s?<U'<9Nrdr7^

9#

BAROC (.baroc) U!$k: Risk Manager EIF rHQ9k[HsIN"Wj1<7gsK

O"Risk Manager EIF ,5]<H9k$YsHN/i9r-R9k .baroc U!$k,U$

F$^9#$YsH&5<P<O"3NU!$krm<I7F$J$H"Risk Manager EIF

+iu.9k$YsHr}rG-^;s#.baroc U!$kO"$YsH&5<P<N$s9

H<k~K+0*K$s9H<k*hSm<I5l^9#

/i9jA9F<HasH (.cds) U!$k: /i9jA9F<HasH& U!$kO"

Risk Manager EIF ,"e.$C)$YsHrCjN/i9K^CW7"$YsHr$Ys

H&5<P<K>w9k0K$YsHN0-rjA9k?aKHQ7^9#

U)<^CH&U!$k: Risk Manager EIFK$YsHrw.9k"Wj1<7gsO"Tj

M09Hjs0rs!9k3H,G-^9#=N?a"lgKhCFOaC;<8r$Ys

H&/i9HM-go;k,W,"j^9#3Nh&JM-go;O"U)<^CH&U!$

krHQ7FT$^9#Lo"U)<^CH&U!$kKO".fmt H$&H%R,U$F$^

9#

(i<&U!$k: Risk Manager EIF (i<&U!$k (GU)kH>O rmad.err) Kh

j"clYkNHl<9,D=HJj^9#Risk Manager EIF NFob8e<k (Q<5

<"+<Mk"U'CA"*hS^CWJI) r*r7FGPC0r"/F#VK7"(i<

dHl<9N$UNlYkGNGPC0rT&3H,G-^9#Fb8e<kHlYkNZ"

4HK"LDNm0&U!$krXj9k3H,G-^9#3Nh&JGPC0!=KO"g

LNG#9/&9Z<9rCq7^9#c2KD$F"psrGgBas9kKO"

rmad.err N9YFN /dev/null $s9?s9r /tmp/filename.err KQ97^9 (Windows

GO \%TEMP%\filename.err)#


6.R

iskM

anag

erE

vent

Integ

ration

Facility

106 P<8gs 3 jj<9 8

Risk Manager TEC ��

Risk Manager O"Tasks for Enterprise Risk Management (\qGO Tivoli Enterprise Console

(TEC) N?9/HFsG$^9) H$&?9/&i$Vij<rs!7^9#Risk Manager

O"TEC-Region H$&GU)kHN TEC ]j7<&j<8gsK3N?9/&i$Vij

<r$s9H<k7^9#

\OO"TEC GT&?9/N/$C/&jU!ls9G9#F?9/N\YKD$FO"C

jN"@W?<NOGb@7F$^9#

TEC ��Tivoli Enterprise Console ?9/O"TEC GT&?9/G9#CjN"@W?<,$s9H<

k5lF$k79F`GO"=N>N3^sIrBT9k3H,G-^9#F"@W?<KD

$FNOGO""@W?<G-N3^sIKD$Fb@7^9#

TEC ?9/4HK"J<rXj9k,W,"j^9#

¶ ?9/PONw.h (G#9Wl$^?OU!$kN>0)

¶ ?9/rBT9k(sI]$sH

UNIX �� TEC ��TEC ?9/rHQ7F8`N UNIX 79F`?9/rBT9kKO"J<Nh&K7^9#

1. Tivoli G9/HCWG"Tasks for Enterprise Risk Management H$&?$HkNTEC ?9/&i$Vij<r/jC/7^9#

2. !Nj9H+i"BT9k TEC ?9/r/jC/7^9#

Deactivate_Unix_User_Account3N TEC ?9/O"f<6<N"+&sHrsh0=9k?aNf<6< ID r

Xj9k?aKHQ7^9#

List_Active_Unix_Processes3N TEC ?9/O",WJ"Wj1<7gs&Wm;9 ID (PID) N>0,,+

CF$klgK"HQ9k!wU#k?<rXj9k?aKHQ7^9#U#k?

<rXj7J$lgO""/F#VJWm;9,j9H5l^9#

View_Component_Status_for_Unix3N TEC ?9/O"UNIX I}P]N<IeN Risk Manager 5<P<Nu7r

=(9k?aKHQ7^9#

7


7.R

iskM

anag

erT

EC��

��

Kill_Unix_Process3N TEC ?9/O"d_9kWm;9NWm;9 ID (pid) rXj9k?aKH

Q7^9#

Run_Unix_CommandBT9k UNIX 3^sIr~O7^9#

Windows �� TEC ��Windows 79F`Nlg"*Zl<F#s0&79F`KU07F$kI}D<k (f<6

<&^M<8c<) rHQ7?H-K"79F`KhCF;-ejF#<&$YsHrhj~

`+I&+r)f9k3H,G-^9#3N?9/GO"Windows 79F`N(sI]$s

HeN;-ejF#<&$YsHNF:rHQG-kh&K7?j"HQG-J$h&K9k

3H,G-^9#

Wm0i` rmt_ntaudit.exe O"F:5lk79F`GHQG-kh&K7F*+J1lP

Jj^;s#3NWm0i`r[[9kH-KO"Risk Manager KU09k Task Support for

Tivoli Host IDS for Windows WmU!$krHQ7^9#

TEC ?9/rHQ7F8`N Windows 79F`&?9/rBT9kKO"J<Nh&K7

^9#



Run_Windows_NT_CommandBT9k Windows 79F`&3^sIr~O7^9#3N?9/rBT9kK

O"Perl r Windows 79F`eK$s9H<k7"Perl $s?<Wj?<NLV

r PATH bKjA7F*+J1lPJj^;s#

Enable_Windows_NT_Event_Auditing3N TEC ?9/O"Windows 79F`eGN$YsHF:rHQG-kh&K

9k?aKHQ7^9#

.y^?O:TNMr*r7^9#

¶ .y*hS:T

¶ .y

¶ :T

¶ .yGb:TGbJ$

$YsH&?$Wr*r7^9#

¶ m0*s*hSm0*U

¶ U!$k*hS*V8'/H&"/;9

¶ f<6<"BNHQ

¶ f<6<*hS0k<WI}

¶ ;-ejF#<&]j7<NQ9

¶ FO0"*;"*hS79F`

¶ Wm;9&HiC-s0

108 P<8gs 3 jj<9 8

Disable_Windows_NT_Event_Auditing

3N TEC ?9/O"Windows 79FèN$YsHF:rHQTDK9k?a

KHQ7^9#

Deactivate_Windows_NT_User_Account3N TEC ?9/O"f<6<N"+&sHrsh0=9k?aN Windows 79

F`Nf<6< ID rXj9k?aKHQ7^9#

List_Active_Windows_NT_Services3N TEC ?9/O"Windows 79FèG"/F#VKJCF$k Windows 7

9F`N5<S9rj9H9k?aKHQ7^9#

View_Component_Status_for_Windows NT3N TEC ?9/O"Windows 79FèN Risk Manager 5<P<Nu7r=

(9k?aKHQ7^9#

POO"!NcNh&KJj^9#

rmcorr_cfg:Info: ---------------------------------------------rmcorr_cfg:Info: Checking Status of Risk Manager Components...rmcorr_cfg:Info: ---------------------------------------------rmcorr_cfg:Info: TMR Host: myTMRserverrmcorr_cfg:Info: TMR install dir: f:/Tivoli/bin/w32-ix86rmcorr_cfg:Info: Region name: myTMRserver-regionrmcorr_cfg:Info: Risk Mgr install dir: f:/Tivoli/bin/w32-ix86/

RISKMGR/corrrmcorr_cfg:Info: Current rulebase: rm1002rmcorr_cfg:Info: Current rulebase path: f:\myrulebasermcorr_cfg:Info: Event cache size: 2000rmcorr_cfg:Info: Class RM_SensorEvent is definedrmcorr_cfg:Info: Rules files in rulebase:

Rule Set files--------------normalization.rlssensorevent.rlssituation.rlstimer.rlsboot.rls

Start_Windows_NT_Service3N TEC ?9/O"+O9k Windows 79F`N5<S9N>0rXj9k?

aKHQ7^9#

?H(P"Apache Web 5<P<r+O9klgKO"5<S9>H7F apache

rXj7^9#^?"Check Point FireWall-1 Q"@W?<r+O7?$lgK

O"5<S9>H7F rma_cpfw rXj7^9#

Stop_Windows_NT_Service3N TEC ?9/O"d_9k Windows 79F`N5<S9N>0rXj9k?

aKHQ7^9#

��7�;�� TEC ��Risk Manager TEC N$YsHO"TEC G<?Y<9rHQ7F"<+$V9kh&KXj9

k3H,G-^9#$YsHr}W>A"^?O Tivoli Decision Support HHQ9k?aK]

I9klgO"J<N?9/rHQ9k3H,G-^9# Tivoli Decision Support KD$F

O"VTivoli Decision Support for Enterprise Risk ManagementWr2H7F/@5$#


7.R

iskM

anag

erT

EC��

��

TEC G<?Y<9bN Risk Manager N$YsHN9JCW7gCHrn.9klgKO"

Archive_Sensor_Events r*r7F/@5$#

j|*KBT9kh&918e<k9kKO"Schedule_Event_Archiving r*r7F/@

5$#

$YsH,"<+$V5lF$J$Bj"j0^?Oj|*J918e<kN$:lG"CF

b"TDS l]<HOG<?rn.7^;s#TDS rHQ7J$lgO"$YsHr"<+$

V9k,WO"j^;s#TDS l]<HrHQ7F"=lr=(9klgO"j|*J"<

+$Vr918e<k7F/@5$#TEC ?9/rHQ7F$YsHr"<+$V9kK

O"J<rT$^9#



Archive_Sensor_EventsTivoli Decision Support rHQ7?G<?&^$Ks0N?aK"Risk Manager N

;s5<&$YsH&G<?r"<+$V9kKO"3N?9/r*r7^9#?

9/,BT5lk4HK"^@"<+$V5lF$J$ Risk Manager ;s5<&

$YsH, TEC N$YsH&j]8Hj<+i Risk Manager N"<+$V&F

<VkK3T<5l^9#9YFN$YsH0-,3T<5lko1GO"j^;

s#\YKD$FO"VDecision Support Guide for Enterprise Risk ManagementW

Gb@7F$^9#

Schedule_Event_Archiving"<+$Vrj|*KBT9kh&K918e<k9kKO"3N?9/r*r7

^9#

Archive_Sensor_Events ,+O7?eNVVr,GXj7^9#3lKhj?9

/O"=NVV4HK$D^Gb+jV5l^9#

VVN95r,GXj7^9#GU)kHO"1 ~VK 1 s (60 ,4H) G9#

3NVV,~;9k?SK"^@"<+$V5lF$J$ Risk Manager N;s5

<&$YsH,9YF"TEC $YsH&j]8Hj<+i Risk Manager "<+

$V&F<VkK3T<5l^9#

9YFN$YsH0-,3T<5lko1GO"j^;s#\YKD$FO"

VDecision Support Guide for Enterprise Risk ManagementWGb@7F$^9#

Risk Manager �� TEC ��Risk Manager O"Tivoli G9/HCW+i Risk Manager "@W?<r+O9k?aN?9

/rs!7F$^9# TEC ?9/rBT9k0K""@W?<,(sI]$sHeK$s9

H<k5lF$k3HrN'7F/@5$#

Risk Manager O"Risk Manager "@W?<r+O9k?aNJ<N TEC ?9/rs!7F

$^9#

Start_Cisco_Secure_IDS_Adapter

Start_CheckPoint_FW-1_Adapter_on_Windows_NT

Start_CheckPoint_FW-1_Adapter_on_Solaris

110 P<8gs 3 jj<9 8

Start_NIDS_Adapter

Risk Manager �� TEC ��TEC ?9/O"Risk Manager "@W?<rd_9klgKHQ9k3H,G-^9# TEC

?9/rBT9k0K""@W?<,(sI]$sHeK$s9H<k5lF$k3HrN'

7F/@5$#

Risk Manager O"Risk Manager "@W?<rd_9k?aNJ<N TEC ?9/rs!7F

$^9#

Stop_Cisco_Secure_IDS_Adapter

Stop_CheckPoint_Firewall_Adapter_on_Windows_NT

Stop_CheckPoint_Firewall_Adapter_on_Solaris

Stop_NIDS_Adapter

Check Point FireWall-1 �� TEC ��Windows 79F`*hS Solaris eN Check Point FireWall-1 Q"@W?<r+O*hSd_

9k?aN?9/KC(F"Risk Manager O"3N"@W?<lQN!N TEC ?9/rs

!7F$^9#

CheckPoint_FW-1_by_IP_Addressb@KD$FO"186Z<8NXIP "Il9psNWaYr2H7F/@5$#

CheckPoint_FW-1_by_Source_and_Destinationb@KD$FO"187Z<8NX=<9*hS8hKD$FNpsNWaYr2H7F

/@5$#

Cisco Secure PIX Firewall �� TEC ��Cisco Secure PIX Firewall Q Risk Manager "@W?<KO"Cisco Secure PIX Firewall ;s

5<N=.Ky40rC(k?aKHQG-k TEC ?9/N;CH,U07F$^9#

Risk Manager O"Cisco Secure PIX Firewall QKJ<N TEC ?9/rs!7F$^9#

Configure_PIX_Firewall_Access3N?9/O"PIX Firewall N=.rQ97F"\3 ({8*hS7,N>}) rV

mC/=7?j"sVmC/= (FN)rvD9k) 7?jG-kh&K7^9#

Configure_PIX_Firewall_Logging3N?9/O"PIX Firewall Nm.s0=.rQ99kNG"Firewall r7,N Risk

Manager ;s5<H7FJ1KH_~`3H,G-^9#b@KD$FO"172Z<8

NX;s5<&m.s0=.NQ9Yr2H7F/@5$#

Show_PIX_Firewall_ConfigurationPIX U!$"&)<kN=_N=.r=(7^9#3N?9/rHQ9kH"5$H

N;-ejF#<&]j7<N$sWjasF<7gsr!:9k3H,G-^9#

b@KD$FO"172Z<8NX;s5<=.psN=(Yr2H7F/@5$#


7.R

iskM

anag

erT

EC��

��

Cisco Secure IDS �� TEC ��Risk Manager O"Cisco Secure IDS Q"@W?<lQN Configure_Cisco_DataFeed TEC ?9

/rs!7F$^9#3N?9/O";s5<H Cisco Secure IDS Q Risk Manager "@W

?<HNVNL.r;CH"CW7^9#\7/O"139Z<8NXCisco Secure IDS Q"@

W?<Yr2H7F/@5$#

112 P<8gs 3 jj<9 8


3NOGO"J<N@KD$Fb@7^9#

¶ XWeb Intrusion Detection System N5WY

¶ 115Z<8NX5]<H5lk Web 5<P<Y

¶ 120Z<8NXWeb IDS $YsHKP9k TEC jXY

¶ 122Z<8NXWeb IDS N$s9H<kY

¶ 128Z<8NXI}?9/Y

Web Intrusion Detection System NaC;<8KD$FO"277Z<8NXWeb IDS NaC;

<8Yr2H7F/@5$#

Web Intrusion Detection System ��Web Intrusion Detection System (Web IDS) O"Web 5<P<,8.9k"/;9&m0&U

!$kr,O7^9# Web Intrusion Detection System O"3liNU!$kr,O7F

Web 5<P<6br!P7^9#

Web IDS O"N1Y<9N"Wm<ArHQ7F-UN"k0nr!P7^9#Web IDS

O"Web 5<P<6bNFQ70KAc< rjA9k3HKhCF"5^6^J6br!P

9k3H,G-^9#6b70KAc<O"1cJF-9H&9Hjs0 (phf JI)"^?O

!NcNh&J Perl 5,==G-R9k3H,G-^9#

(?i)count¥.cgi

Risk Manager KO"Web 5<P<6bQN70KAc<r^` sig.nefarious U!$k,

H_~^lF$^9#

Web 5<P<r*}ANlgO"Web IDS rHQ7F/@5$#Web IDS O"Web 5<P

<4HK$s9H<k7F/@5$#

J<rT&KO"Web IDS rHQ7^9#

¶ j"k?$`&b<I^?OPCA&b<IG,OrBT7^9#

j"k?$`&b<I

"/;9&m0&U!$kbN9YFN7,m0`\,I_hil^9#,O

O"7,m0`\,m0&U!$kKIC5lk~KBT5l^9#j"k?$

`&b<INlgO"bK?<P]NF Web 5<P<K Web IDS r[V7J1

8


8.W

ebIn

trusio

nD

etection

lPJj^;s#Web IDS O"m<k*<P<&m0&5]<Hr5]<H7F

$^9#121Z<8NXm<k*<P<&5]<HN?aNm0&U!$k&"/

;9NXjYGO"m0&U!$k&"/;9r918e<k9k?aN Web

IDS N=.}!KD$Fb@7F$^9#

PCA&b<I

Web IDS O"Web 5<P<GBT9k,WO"j^;s#Web IDS O@(*K

BT5l"m0&U!$krlY@1I_hj^9#

¶ [9H+iNWa,"i<`r/9kH",:=N[9H+iNWarhj~_^9#3

lKhj"3Nhj~^l?psr,O7"70KAc<&U!$kG7,N70KAc

<rjA9k3H,G-^9#70KAc<rj0G,O9k}!KD$FO"131Z<8

NXWeb 6b$YsHN,OYr2H7F/@5$#^?"7,N Web 6b70KAc

<NjA}!""k$OE$ Web 70KAc<N|n}!KD$FO"133Z<8N

XWeb 6b70KAc<NICH|nYr2H7F/@5$#

¶ spJ7[oNtr)B7^9#[9HNCjN;CHrHi9FCI H7FjAG-^

9# Web IDS ,Hi9FCI&[9H+iWaru1hkH"3liNWaNkLH7

F8.5lk"i<`O9YF^_5l^9#3N^_O"Hi9FCI&MCHo</

I}T,kHbG9-cs&=UH&'"rHQ9klgKr)A^9#3NU#<Ac

<Khj"?/N6N"i<`,|n5l^9# 135Z<8NXHi9FCI&70KA

c<NIC^?O|nYr2H7F/@5$#

¶ ,ON?aK-?9kT3J"/F#SF#<N?$W ("i<H"Yp"^?O=N>

}) rXj7^9#\YO"135Z<8NXT3J"/F#SF#<N?$WNXjYr2

H7F/@5$#

¶ 9-cs9Y-T3J[9HN1LrD=K7^9#\YO"134Z<8NXT3J[9H

NIC^?O|nYr2H7F/@5$#

~VH&K}85l?N1rxQ9kh&K Web IDS r409k3H,G-^9#\YO"

136Z<8NX7-$MH:jMN40Yr2H7F/@5$#

115Z<8N^18 O"Web 5<P<"Web IDS"*hS Tivoli Enterprise Console (TEC) 5

<P<NVNG<?N.lr(7?bNG9#

114 P<8gs 3 jj<9 8

�� Web ��Web IDS O"J<N Web 5<P<G"/~!N$YsHrbK?<9k3H,G-^9#

= 17. Web IDS ,5]<H9k Web 5<P<

Web IDS ,5]<H9k Web 5<P< m0&U!$k&U)<^CH

Windows 79F`"AIX"*hS Linux G

Apache Web 5<P<

CLF "/;9&m0&U!$k&U)<^CH

Windows NT"AIX"Solaris"*hS Linux eN

Lotus Domino Server

CLF "/;9&m0&U!$k&U)<^CH

Windows NT"AIX"Solaris"*hS Linux eN

IBM HTTPD Server

CLF "/;9&m0&U!$k&U)<^CH

Windows NT"AIX"*hS Solaris eN Tivoli

Policy Director WebSeal Server

CLF "/;9&m0&U!$k&U)<^CH

Windows NT"AIX"Solaris"*hS Linux P~N

iPlanet Web Server Enterprise Edition (J0N

Netscape Enterprise Server) P<8gs 4.1

CLF "/;9&m0&U!$k&U)<^CH"

^?O+9?^$:5l?"/;9&m0&U!

$k&U)<^CH

Microsoft Internet Information Server (IIS) for

Windows NT

J<NU)<^CH:

¶ W3C H%U)<^CH (W3C)

¶ Internet Information Server (IIS)

¶ *<Ws&G<?Y<9&3M/F#SF#<

(ODBC)

¶ National Center for Supercomputing Applications

(NCSA)

,WK~8F"H+N Web 5<P<r=.9k,W,"j^9 (124Z<8NXWeb 5<P

<&"/;9&m0&U!$kN=.Yr2H)#?H(P"W3C H%U)<^CHr Web

^ 18. Web 5<P<+i Web IDS rP37F TEC 5<P<Kjk^GNG<?N.l


8.W

ebIn

trusio

nD

etection

IDS GHQ9kKO"VExtended Property (H%WmQF#<)W&#sI&GCjN*W7g

sr*r9k,W,"j^9 (jgKD$FO"125Z<8NXMicrosoft Internet Information

Server N=.Yr2H7F/@5$)#

Perl ��Web IDS rHQ9kKO"5]<H5lkFWiCHU)<`QN Perl NP$Jj<[[U

!$k,,WG9# Risk Manager KO",\N Perl [[U!$k,^^lF$^9#

Risk Manager Perl [[U!$kKO"Risk Manager EIF HN$s?<U'<9rs!9k

Perl b8e<k (rmadpm.pm) b^^lF$^9#GU)kHMO"3N!=r Web IDS H

&KHQ9kh&KJCF$^9#

^?"m0&U!$k&"@W?<rHQ7F$YsH&5<P<K$YsHrw.7"jX

h}rT&3HbG-^9#

CLF ��&��1��)��Web 5<P<O""/;9&m0&U!$kGWarIW7F$^9#Web 5<P<O"W

ar"/;9&m0&U!$kKw.7^9#Web 5<P<KhCFn.5lk"/;9&

m0&U!$kKO"Web 5<P<,8.9ku7psKC(F"Web 5<P<K]9H5

l?Wa,^^l^9#Web IDS O"Web 5<P<N"/;9&m0&U!$krI_hj

^9#

Web 5<P<K~8F""/;9&m0`\OCjNU)<^CHrHQ7FU)<^CH

_j5l^9#GblL*JU)<^CHN 1 DO"Apache Server *hS iPlanet Web

Server (J0N Netscape Enterprise Server) ,HQ9k"&Lm0&U)<^CH (CLF) G

9# Web IDS O"3liNU)<^CHr5]<H7F$^9#

Web IDS O"&Lm0&U)<^CH (CLF) m0&U!$kr=8rO7^9#CLF OL

o"7)KO CLF H7Fn.5lF$J$U)<^CHKP7F!=7^9#m0`\NG

iNt,, CLF K`r7F$klg"Web IDS O"GeK"kICU#<kIr5k7^

9#

"/;9&m0&U!$k&U)<^CHrXj9kKO"Web 5<P<r57$U)<^

CHK=.7J1lPJj^;s#

m0&U)<^CHrm0&U!$kKH_~_"-qM-<r=.-<KXj9klg"

Web IDS O=NpsrHQ7F7,m0&U!$k&U)<^CHr>A7^9#

-qM^?O3asHMrXj7J$lg"Web IDS ,m0`\r,%9kNKHQ9k5

,==K`r7F$J$FWaO"Yp$YsHrz-/37^9#?H(P"PCA&b<

INBTfK"m0&U)<^CHrm0&U!$kNGiNTH7Fq-~` Web 5<P

<b"j^9#3l,88kH"m0`\, CLF K`r7F$J$NG" Web IDS OJ<

N$YsHr8.7^9#

ALERT :parser(readAccessLog)==><line1>:Malformed line in the logfile. the other tests skipped.

sig.nefarious ��3<:��)��Risk Manager N sig.nefarious U!$kO"Web 6bN70KAc<r]I7^9#Web

IDS O"3NU!$krHQ7F Web 5<P<rbK?<7"6b,J$+I&+r4Y^

9#

116 P<8gs 3 jj<9 8

$s9H<keNGU)kHN sig.nefarious U!$kO"J<NljK"j^9#

Windows 79F`:

Tivoli¥lcf¥bin¥w32-ix86¥RISKMGR¥adapters¥etc¥

AIX 79F`:

/opt/Tivoli/lcf/bin/aix4-r1/RISKMGR/adapters/etc/

Solaris 79F`:

/opt/Tivoli/lcf/bin/solaris2/RISKMGR/adapters/etc/

Linux 79F`:

/opt/Tivoli/lcf/bin/linux/RISKMGR/adapters/etc/

H+N70KAc<&U!$krn.9kKO"Risk Manager N$s9H<k~Ks!5l

?GU)kHN70KAc<&U!$kr3T<9k+"70KAc<&U!$kNG7P<

8gsrJ<N Tivoli Support Web 5$H+i@&sm<I7F/@5$#

http://www.tivoli.com/support/secure_download_bridge.html.

webids.cfg =.U!$krT87F"m<I9k70KAc<&U!$kN7,NQ9*h

S>0rXj9k,W,"j^9#_j9k,WN"kMO signatureFilePath_value= G9#

70KAc<rn.9kKO"Perl N5,==NN1,,WG9#70KAc<&U!$kr

n.^?OQ99kH-O"J<Np\k<kK>CF/@5$#

¶ PC/"CWQK"5NGU)kHN sig.nefarious U!$kr3T<7F>0rQ97

^9#

¶ webids.cfg =.U!$krT87F"7,N70KAc<&U!$kN04$~Q9rX

9h&K7^9#?H(P"!Nh&K7^9#

signatureFilePath_value = ¥Fully_Qualified_Path¥new_filename

¶ /i9O"/i9&XC@<H70KAc<Nj9HG=.9k,W,"j^9#

¶ F70KAc<rL9NTKV-^9#

¶ 70KAc<NTKO"!N`\râ^9#

1. Perl N5,===8G=5l?70KAc<

2. 6bN>0r=9F-9H&9Hjs0

3. 79Fè@Y ID (,+CF$klg)

4. CVE "k$O Bugtraq JIN79Fè@YNps;

¶ e-N 4 DN`\O"4 DNsKV+l^9#J<Kcr(7^9#

(?i)showcode¥.asp showcode.asp [CAN-1999-0737] [CVE]

¶ 7,N70KAc<rjA9kH-O"70KAc<>NltH7F]sI-f (#) rH

Q7J$G/@5$#]sI-fhjbeNF-9HO5k5l^9#

¶ ]sI-f (#) G+O7J$T"[engine= G#l/F#V"^?O [class= G#l/F

#VO"70KAc<G"kH+J5l^9#

¶ Web IDS O"uNTr5k7^9#


8.W

ebIn

trusio

nD

etection

¶ 1lN/i9>O"3liN/i9,[Jk(s8sK"klgKBjHQD=G9#/

i9>O"F(s8s&;/7gsbGO"G-G"k,W,"j^9#

¶ Web IDS ,sp9k/i9O 1 D@1G"k?a"`wN6b70KAc<O1lN/

i9K~l^9 (?H(P"#tN79F`e@ cgi Wm0i`O1l/i9K~l^

9)#

¶ [class= G#l/F#VO"!N [engine= ^?O [class= G#l/F#V,PF/k^

G"U!$kNfr<}~KI_hil^9#

¶ ;_3ms (;) GQia<?<r,%7^9#

sig.nefarious U!$kKOgJ;/7gs,"j"F;/7gsK70KAc<,~CF$

^9 (/i9H7FjA5lF$^9)#3NU!$kGHQ5lk;/7gsO"a$s&(

s8sKP~7F$^9#

��9�0�

3N(s8sO"m0&U!$kNI_}rX(7"BT9k,ON?$Wr=L7^9#T

3"/F#SF#<NcH7FO"CjN8zr 16 JtG(s3<I9k3H,s2il^

9#

Q<5<&(s8sO"a=CI"9Hjs0"*hSWmH3kr>A9kF9HrBT7

F"J<NT3 URL "/F#SF#<r!P7^9#

¶ m0&l3<INU#<kI,gn7F$kJINm0`\NT,JJU)<^CH#

¶ |~psN}r^?Ora,T=

¶ uN URL Wa

¶ 57/J$ URL A0

¶ URL WaGHQ5lF$k5zJ 16 Jt(s3<I

¶ HqWaGHQ5lF$k5zJ 16 Jt(s3<I

¶ URL WaGHQ5lF$kT3 16 Jt3<I

¶ HqWaGHQ5lF$kT3 16 Jt3<I

3liN/i9OjAQ_G9#/i9rIC^?O|n9k3HOG-^;s#

/i9&XC@<NA0O"!NH*jG9#

[class=classname; level1=count1; level2=count2; k=decay_param]

J<N/i9&Qia<?<@1,Q9D=G9#

¶ level1=count1;

¶ level2=count2;

¶ k=decay_param

Q<5<&(s8sN/i9&Qia<?<r409k}!KD$FO" 136Z<8NX7-

$MH:jMN40Yr2H7F/@5$#

118 P<8gs 3 jj<9 8

��9�0�

Q?<s&(s8sO"m0&U!$k`\NXj7?U#<kINfG6b70KAc<r

!w7^9#Q?<s&(s8s,!w9kU#<kIN?$WNcO"!NH*jG9#

¶ url

¶ status

¶ query

¶ method


[class=classname; field=fieldname ; level1=count1;level2=count2; k=decay_param]

3N(s8sO"Q<5<&(s8sH1MK"m0`\KP7FF9HrBT7^9#F9

HGYp,/;il?lg"J<N@rN+ak?aKICNF9HrBT9k3H,G-^

9#

¶ T3JWaNHqU#<kINfKT3J`\b"k+I&+

¶ T3JWa,.y7?+I&+

¶ T3JWaK 16 Jt(s3<I (16 J3<I) ,^^lF$k+I&+

kgF9HNlgN/i9&XC@<NA0O"!NH*jG9#

[class=classname; field=field; requires=class; level1=count1;level2=count2; k=decay_param]

G7N/~!NrT&KO"7?K/+5l?6b*hS79F`Ne@r"3NU!$kN

70KAc<&j9HKIC7F/@5$#?i+N;-ejF#<DNNG<?Y<9rH

Q7F"j|*K77$6br4YFIW7F/@5$#

Web IDS Q?<s&(s8sr=.9kKO" sig.nefarious U!$kNQ?<s&(s8

s&;/7gsrT87^9#=.?9/O"!NH*jG9#

¶ 133Z<8NXWeb 6b70KAc<NICH|nY

¶ 132Z<8NX70KAc<&/i9NICH|nY

¶ 136Z<8NX7-$MH:jMN40Y

¶ 133Z<8NXQ?<s&F9HNkgH\Y=Y

suspicion 9�0�suspicion (s8sO"T3G"kH+J5l?[9HrHiC/7^9# Web IDS ,Yp

^?O"i<Hr/9k6xHJkWar"k[9H,w.7?lgO"=N[9H>r

sig.nefarious U!$kKIC7F"3NCjN[9HNHiC/rQ39k3H,G-^

9#


[class=suspiciousHosts; printLvl=level]

Web IDS r=.9kKO"sig.nefarious U!$kN suspicion (s8s&;/7gsrT

87^9#=.?9/O"!NH*jG9#

¶ 134Z<8NXT3J[9HNIC^?O|nY


8.W

ebIn

trusio

nD

etection

¶ 135Z<8NXT3J"/F#SF#<N?$WNXjY

*��9�0�

[9HNCjN;CHrHi9FCI H7FjAG-^9#Hi9FCI&[9H+iWa

ru1hC?H-K8.5lk"i<`O9YF^_5l^9#3N^_O"Hi9FCI&

MCHo</I}T,9-cs&=UH&'"rkHbGHQ9klgKr)A^9#?/N

6N"i<`O|n5l^9#

70KAc<NCjN;CHrHi9FCIH7FjA9k3H,G-^9#5^6^J6b

r!P9kKO"6b70KAc<NFQ-rD=JBjb/7^9#7+7"6b70KA

c<NFQ-NYg$rb/7a.kH"6"i<`,/05lk3H,"j^9#Hi9

H&(s8srHQ9kH"6"i<`Ntr:i93H,G-^9#^:""k70KAc

<rHi9FCIKG-kH=G7^9#!K"6"i<`Ntr:i9?aK3N70KA

c<rIC7^9#


[class=classname; field=fieldname; cancels=class]

J<Kcr(7^9#

[class=trustedSig; field=url; cancels=all]/cgi-bin/fortune/cgi-bin/here

Web IDS r=.9kKO"sig.nefarious U!$kNHi9H&(s8s&;/7gsrT

87^9#=.?9/O"135Z<8NXHi9FCI&70KAc<NIC^?O|nYG

9#

�"+��9�0�

9-CW&(s8sO"Hi9H&(s8sH`w7F$^9#9-CW9k70KAc<N

CjN;CHr (5,==H7F) jA7^9#Web IDS O"3NQ?<sKlW9kWaO

lZh}7^;s#9-CW&(s8sHHi9H&(s8sNc$Oo:+G9,"EWG

9#Hi9H&(s8sGO"lW7?H-K""i<HNCjN/i9rhjC970KA

c<rjA7^9#9-CW&(s8sGO"70KAc<,lW7Fb"WaKP7FO?

bBT5l^;s#GU)kHGO"Web IDS O"gif *hS jpg N$a<8KP9kWa

Oh}7^;s#3liNU!$kO6bN=<9KOJiJ$+iG9#J<Kcr(7^

9#

[class=pictures; field=url]¥.gif$ gif¥.jpg$ jpg

Web IDS �� TEC ��6b,!P5lkH"Web IDS O$YsHr8.7"J<N$:l+rHQ7F=N$Ys

Hr TME "@W?<Kwj^9#

¶ ,ZJm.s0!= (UNIX syslog ^?O Windows NT Event Log "@W?<N$:l

+)

¶ Risk Manager EIF HN$s?<U'<9rs!7F$k Perl b8e<k

Tivoli $YsH&5<P<O=N$YsHrjXh}7"=lir0k<W=7F"MCHo

</N;-ejF#<u7r=9J1J^r=(7^9#jXWm;9O"79F`N;-e

120 P<8gs 3 jj<9 8

jF#<KHCFEWJ$YsHrb$EgYlYkG=(7"=lKX"psrJiJA0

Gâkh&K9kNKr)A^9#jXrBT9kH"k@rY}9kNK=,Jps,#

tN=<9+is;ilF$k3H,N'5lkNG"mC?"i<`N/8(bc<7^

9#Risk Manager $YsHjXN\YKD$FO"57Z<8NXRisk Manager Server

CorrelationYr2H7F/@5$#

Web IDS �� Risk Manager Event Integration FacilityWeb IDS NGU)kHN$s9H<k&79FÒ"Risk Manager EIF rHQ7F Web

IDS N$YsHr Risk Manager 5<P<Kw.9kh&K"Web IDS r;CH"CW7^

9# Web IDS , Risk Manager EIF rHQ7F Risk Manager 5<P<K$YsHrw.9

kh&KXj9kKO"webids.cfg K librmad_value=1 r_j7^9#

^?"Web IDS N$YsHr*Zl<F#s0&79F`Nm0Kw.9kh&"Web IDS

r=.9k3HbG-^9# Web IDS ,=N$YsHr*Zl<F#s0&79F`Nm0

Kw.9kh&KXj9kKO"webids.cfg K librmad_value=0 r_j7^9#

UNIX 79F`$YsHO"syslog Kw.5l^9#79F`&m0+i Web IDS N$YsHrj

P7F"=lir Risk Manager 5<P<Kw.9kKO"TEC m0&U!$k&"

@W?<rHQ7^9#

Windows 79F`$YsHO"$YsH&m0Kwil^9#79F`&m0+i Web IDS N$Ys

HrjP7F"=lir Risk Manager 5<P<Kw.9kKO"TEC Windows N

$YsH&m0&"@W?<rHQ7^9#

1��1��)��&��[HsIN Web 5<P<O"Xj7?~V,Pa9kHLNm0&U!$kKZjX(kh

&K918e<k9k3H,G-^9 (?H(P 1 |K 1 s)# Web IDS O"*;;:K7

,Nm0&U!$kKZjX(k3HbG-^9# webids.cfg bNQtrT87F"m0&

U!$krXj7F/@5$#

filePattern_value-zJm0&U!$kr+U1k?aKHQ9k5,==r Web IDS KXj7^

9# Web IDS O"3NQ?<sKlW9kG7NQ9U!$krHQ7^9#

filePath_valuem0&U!$k,8_7F$kG#l/Hj<rXj7^9#

fileMatch_value

1 m<k*<P<&m0&5]<HrHQD=K7^9#

0 m<k*<P<&m0&5]<HrHQTDK7^9# Web IDS O"

filePattern_value H filePath_value *hSEMr5k7^9#

?H(P"UNIX 79FèN Apache Nlg"!Nh&KJj^9#

filePattern_value = access_log.*filePath_value = /usr/local/apache/logsfileMatch_value = 1


8.W

ebIn

trusio

nD

etection

-i *W7gsrU1F3^sITGXj5l?U!$kO" webids.cfg GXj5l?Mr*

<P<i$I7^9#?@7"3Nps,=.U!$kGXj5lF$klgO"3^sIT

GU!$k>r@(*KXj9k,WO"j^;s#

Web IDS ��Web IDS H=N0sroN=JO"Tivoli N(sI]$sH^?O Tivoli J0N79F`K

$s9H<k9k3H,G-^9#*Zl<F#s0&79F`Nm0*hSX"9k TEC

"@W?<rHQ7F$YsHr TEC K>w9k=j,J$lgO"Web IDS H=N0s

ro (Risk Manager Perl H Risk Manager EIF r^`) N$s9H<kN\YKD$F"33Z

<8NXRisk Manager N$s9H<kYr2H7F/@5$#

Web �� Web IDS ��Web IDS KO"Web IDS N*W7gsr_j*hS=.9k?aN=.U!$k

webids.cfg ,QU5lF$^9#3N=.U!$kKO"Risk Manager Web IDS ,5]<

H9k Web 5<P<4HK;/7gs,^^lF$^9#

m: =.9k Web 5<P<N?$WKgC?"=.U!$kN57$;/7gsrT89k

h&K7F/@5$#

GU)kHGO"&Lm0&U)<^CH (CLF) rHQ9k Web 5<P<QN=.KJC

F$^9#GU)kHNU)<^CHG"k CLF +iLNm0&U!$k&U)<^CHK

Q99kKO" CLF `\r3asH=7"=.9k Web 5<P<N?$WQN=.U!$

kN57$;/7gsr+U1F/@5$#^?"]sI-f (#) r|n7F"=N;/7g

sNTN3asH=rr|7F/@5$#

Web IDS =.U!$krT87F"J<N3HrT&3H,G-^9#

¶ Risk Manager "@W?<&i$Vij<&U!$kXN04$~Q9rXj9k#

¶ -p *W7gs,HQ5lF$klgO"$YsHr TME "@W?< (UNIX syslog +

Windows NT Event Log "@W?<NIAi+)"^?O Risk Manager EIF K>w9k}

!rXj9k#

¶ Web 5<P<Nm0&U!$k=8rXj9k#

¶ 70KAc<&U!$kN04$~Q9*hS>0rXj9k#

¶ Web IDS ,I_hk"/;9&m0&U!$kNU)<^CH"D^j"CLF +io&

9k+ CLF K>&+rXj9k#

¶ (i<P}9F<HasHrs!9k#

¶ u1~lD=J|UA0rXj9k#

¶ -q=.rjA9k#

¶ -<QtH Web 5<P<N-RQlrhZk?aKHQ9kF-9H8zrjA9k#

¶ |n9k0tF-9HrjA9k#

=.U!$krQ99k}!N\YKD$FO" 128Z<8NXWeb IDS =.U!$kNT

8Yr2H7F/@5$#

122 P<8gs 3 jj<9 8

Risk Manager EIF �� Web IDS ��Web IDS NGU)kHN=.GO"Web IDS N$YsHO Risk Manager EIF Kw.5l"

!K"Risk Manager EIF , Web IDS N$YsHr Risk Manager 5<P<Kw.7^9#

Web IDS N$YsHr Risk Manager TEC N$YsHK,ZK^CTs09kKO"Web

IDS U)<^CH&U!$krHQ9kh& Risk Manager EIF r+9?^$:9k,W,"

j^9#

m: Unix 79F`K WebIDS r=.9klgO=N0K"Risk Manager ND-9/jWH

K"J<NQ9rIC7F/@5$#

. /etc/Tivoli/rma_eif_env.sh

Web IDS N$YsHr^CW9kh&K Risk Manager EIF r=.9kKO"webids.fmt U

!$kr Risk Manager EIF rmad.fmt U)<^CH&U!$kNGeKIC7^9#ICe

N rmad.fmt U!$krHQ7F"/i9jA9F<HasH&U!$k (.cds) r=.7^

9# rmad.cds U!$kr=.9kKO"!Nh&K7^9#

1. !Nh&K7F"webids.fmt r rmad.fmt NGeKIC7^9#

Windows 79F`Nlg:

webids.fmt >> rmad.fmt

UNIX 79F`Nlg:

cp webids.fmt >> rmad.fmt

Windows *hS Unix NIAiN79F`Nlgb"Risk Manager EIF O webids.fmt U

!$krHQ7^9#

2. riskmgr_gencds 3^sIrBT7F"/i9jA9F<HasH&U!$k (.cds) rF

n.7^9#

riskmgr_gencds rmad.fmt >rmad.cds

3. Web IDS ,$s9H<k5lF$k79F`K"975l? rmad.cds U!$krF[V

7^9#

Web IDS H;Q9k?aK"ACF rHQ7F rmad.cds r979k}!KD$FO"49Z<

8NXACF rHQ7? Risk Manager "@W?<N=.*hS[[Yr2H7F/@5$#

TEC �� Web IDS ��Web IDS N$YsHr*Zl<F#s0&79F`Nm0 (Unix NlgO syslog"Windows

NlgO Event Log) Kw.9kh& Web IDS r=.9k3H,G-^9#3Nb<IG

Web IDS r=.9kKO"J<N9FCWrBT7^9#

1. webids.cfg K librmad_value=0 r_j7^9#

2. TEC m0&U!$k&"@W?< (^?O Windows NlgO TEC $YsH&m0&"

@W?<) , Web IDS 79F`K$s9H<k5lF$k3HrN'7^9#

3. Web IDS U)<^CH&U!$kr TEC "@W?<NU)<^CH&U!$k

(tecad_logfile.fmt ^?O tecad_nt.fmt) NGeKIC7^9#

UNIX 79F`&m0&U!$k&"@W?<:

webids.fmt


8.W

ebIn

trusio

nD

etection

Windows 79F`&$YsH&m0&"@W?<:

webids.nt.fmt

4. /i9jA9F<HasH&U!$k (.cds) rFn.7^9#!Nh&K~O7^9#

UNIX 79F`Nlg:

../bin/logfile_gencds ../etc/tecad_logfile.fmt >../etc/tecad_logfile.cds

Windows 79F`Nlg:

¥bin¥nt_gencds ...¥etc¥tecad_nt.fmt > ..¥etc¥tecad_nt.cds

5. Web IDS *hS TEC "@W?<,$s9H<k5lF$k79F`K"975l?

tecad_logfile.cds ^?O tecad_nt.cds U!$krF[V7^9#

Web ��&��1��)��Web IDS rHQ9k0K Web 5<P<N"/;9&m0&U!$kr=.7J1lPJj

^;s# Web 5<P<K~8F"=.?9/KO!NbN,^^l^9#

¶ J<N Web 5<P<r CLF G=.9k

v Windows NT"AIX"Solaris"^?O Linux K Apache Web Server r=.9k

v Windows NT"AIX"Solaris"^?O Linux 79F`K IBM Lotus Domino Server r=

.9k

v Windows NT"AIX"Solaris"^?O Linux 79F`K IBM HTTPD (WebSphere)

Server r=.9k

v Windows NT"AIX"Solaris"^?O Linux 79F`K Tivoli WebSeal (Policy

Director) r=.9k

¶ Windows NT"AIX"Solaris"^?O Linux 79F`K iPlanet Web Server (Netscape

Enterprise Server) r=.9k

¶ J<NU!$k&U)<^CHG Microsoft Internet Information Server r=.9k

v W3C

v IIS

v NCSA

v ODBC

��1�� !+�� Web ��

CLF rHQ9k"/;9&m0&U!$krn.9k Web 5<P<O"!NH*jG9#

¶ Windows NT"AIX"^?O Solaris 79FèN IBM Lotus Domino Server

¶ Windows NT"AIX"^?O Solaris 79FèN"IBM WebSphere ,HQ9k IBM

HTTPD (WebSphere) Server

¶ Windows NT"AIX"^?O Solaris 79FèN Tivoli WebSeal (Policy Director) Server

¶ Apache Web 5<P<

Netscape iPlanet Web Server GO"CLF rHQ7F"&Lm0&U)<^CHPOr8.9

k3H,G-^9#=.KX9k\YJb@KD$FO"125Z<8NXiPlanet Web Server

(Netscape Enterprise Server) N=.Yr2H7F/@5$#

124 P<8gs 3 jj<9 8

Tivoli WebSeal (Policy Director) Server ��

WebSeal GO"Wa"jU!i< (js/5Z<8N URL)"*hS(<8'sHNm0&l

3<Ir1lNU!$kK]I9k3H,G-^9#?@7"Web IDS ,}r9kNO"W

am0&l3<IN_G9#WebSeal r=.7"Wam0&l3<Ir"jU!i<ps*h

S(<8'sHpsHOLNU!$kK]I9kH"U!$k&Q9"*hS 3 o`Nm0

psr]I9kljN>0r"WebSeal =.U!$kN wand ;/7gsGXj9k3H,

G-^9#

iPlanet Web Server (Netscape Enterprise Server) ��

iPlanet Web Server (0HO Netscape Enterprise Server) r=.9kKO"J<Nh&K7^

9#

1. /*/netscape/server4 G#l/Hj<K"k startconsole.sh 9/jWH&U!$krB

T7^9#3N9/jWH&U!$kKhj""I_K9Hl<?<ND<k, Netscape

Web Vi&6<G+O7^9#

2. =NZ<8NetK"k VServers (5<P<)W?VN VSelect a Server (5<P<N

*r)WaKe<+i"=.7?$ Web 5<P<r*r7^9#

3. VManage (I})Wr/jC/7F"77$ Web Z<8rm<I7^9#

4. VStatus (u7)Wr/jC/7^9#

5. VLogging Preferences (m.s0_j)Wr/jC/7F""/;9&m0=.Z<8r

=(7^9#

6. VDomain Names (Ia$s>)Wr*r7F"l3<IN?$Wr_j7^9#

7. VUse Common Logfile Format (&Lm0&U!$k&U)<^CHrHQ9k)Wr*

r7FU)<^CHN?$Wr_j7^9#

GU)kHN"/;9&m0&U!$k>H=NLVO"!NH*jG9#

/*/netscape/server4/https-hostname.domain.com/logs/access

Microsoft Internet Information Server ��

Microsoft Internet Information Server (IIS) G WebIDS rHQ9kKO"7,Nm0&U!$

krn.;:K 1 DNm0&U!$krHQ9kh&K IIS r=.9k,W,"j^9#J

<NjgO"1 DN"/;9&m0&U!$krHQ9kh&K IIS r=.9k}!r(7

?bNG9#

1. Microsoft I}3s=<kG Web 5<P<N>0r&/jC/7^9#

2. VProperties (WmQF#)Wr*r7"VWebSiteW?Vr*r7^9#

3. m.s0&;/7gsGVProperties (WmQF#)Wr*r7^9#

4. Vlog period (m0|V)WrVunlimited file size (U!$k&5$:r)B7J$)WKQ97^9#

J<NjgK>&H"IIS Om0r9oCW"&H;:K"18U!$kK]BJ/q-~_

^9#

IIS N W3C H%U)<^CHr=.9kKO" Windows NVExtended Property (H%Wm

QF#<)WN*W7gsNG.B,WJ;CHr*r9k,W,"j^9# (IIS ,s!9


8.W

ebIn

trusio

nD

etection

k"National Center for Supercomputing Applications (NCSA) JIN>NU)<^CHKO

VExtended Property (H%WmQF#<)W*W7gsrs!9k,WO"j^;s#)

W3C U)<^CHQNVH%WmQF#W&#sI&+i"!N*W7gsN;CHr*r

7J1lPJj^;s#

¶ Date (|U)

¶ Time (~o)

¶ Client IP address (/i$"sH IP "Il9)

¶ Method (a=CI)

¶ URI stem (URI l4)

¶ URI query (URI Hq)

¶ Bytes sent (w.P$Ht)

¶ HTTP status (HTTP u7)

¶ Protocol version (WmH3kGVf)

Cookie d Server Port (5<P<&]<H) JINUC*J*W7gsr*r9kH"Web

IDS O"3liN*W7gsKX9kpsr Risk Manager EIF ^?O Windows Event Log

"@W?<Kw.9k0K|n7^9#3lir logPattern ^?O-qjAG ignore K_j

7F/@5$#

H%WmQF#<N04Jj9Hr=(9kKO"J<Nh&K7^9#

1. VMicrosoft Personal WebServerW→V$s?<MCH 5<S9 ^M<8cWNgK/

jC/7^9#

2. 3s=<k+i V{jN Web 5$HWr*r7^9#

3. ,WK~8F"3sTe<?<&[9HN"$3sr8+7^9#

4. VWmQF#W→V"/F#VJm0A0WNgK/jC/7^9#

5. V"/F#VJm0A0(Active Log Format)W+iVW3C Extended Logfile FormatWr*r7^9#

6. VWmQF# (Properties)W→VH%WmQF# (Extended Properties)W?0NgK/

jC/7^9#

*r7?*W7gsO"m0&U!$kK3asHTH7FPO5l^9#?H(P"!Nh

&KPO5l^9#

#Fields: date time c-ip cs-method cs-uri-stem cs-uri-query sc-statussc-bytes cs-version

WmQF#<NG.B,WJ*W7gsr*r7J$H"Web IDS ,(i<NUi0r)F

^9#!K"Web IDS O"gn7F$k*W7gsHm0&U!$kbGNTVfrj9H

7F"!N$YsHr8.7^9#

ALERT :parser(readAccessLog)==>nnnn:Malformed line in the log file.the other tests skipped.

1MK"f<6<>NH%WmQF#<,*r5lF$J$lg"MO hyphen (-) K_j5

l^9#

IIS 5<P<,n.9km0&U!$kO"YYMMDD U)<^CH (?H(P ex000530.log)

GG#l/Hj<K]I5l^9#

126 P<8gs 3 jj<9 8

c:¥winnt¥system¥logfiles¥w3svc1¥exYYMMDD.log

National Computer Security Association (NCSA) U)<^CHrHQ9klg"m0&U!$

kN>0O ncYYMMDD.log HJj^9#

Web IDS ��Web 5<P<O""/;9&m0&U!$kKWaHu7psrw.7^9# Web IDS

O"Web 5<P<N"/;9&m0&U!$krI_hj^9#

J<K"04Jm0`\Ncr(7^9#

some.host.org - - [03/May/2001:03:42:23 + 0000] "GET /cgi-bin/test-cgiHTTP/1.1" 500 345

"/;9&m0&U!$kN`\KO"J<NbN,^^l^9#

¶ WaN/.5HJC?[9HN>0 (?H(P"some.host.org)#

¶ f<6<KX9kps (~jD=Jlg)#

¶ m0&(sHj<,-?5l?|U#

¶ Waps#WaO"URL bN[9H>K3/psG9#?H(P"WapsO!Nh&K

Jj^9#

"GET /cgi-bin/test-cgi HTTP/1.1"

¶ u73<I#5oG"k3Hr(9u73<IO"2nn G9# 4nn ^?O 5nn H$&u

73<IO"(i<r=7^9#

¶ >w5l?P$Ht#

Risk Manager O"Web IDS NEv-!:QNU!$k&;CHrs!7F$^9#!:QN

U!$kOJ<NH*jG9#

¶ test.log

¶ test.result

¶ test.results.evt (Windows 79F`)

¶ test.syslog (UNIX 79F`)

Windows 79F`GO"kLr=(9kKO"$YsH&Se<"<rHQ7F/@5$#

3liNU!$krHQ7F!:rT&lg"=NkLr3s=<kK=(9k+"U!$k

> (?H(P"test.myresult) rXj7F=3KkLrwk3H,G-^9#

test.log U!$krBT9kKO"!N3^sIr~O7F"3s=<kK=(5lkkL

rN'7F/@5$#

webids.bat -i test.log

!:kLpsrU!$k (?H(P"test.myresult) Kq-~`KO"!N3^sIr~O7^

9#

webids -i test.log > test.myresult


8.W

ebIn

trusio

nD

etection

J<K"test.results NbFNlcr(7^9#

# 956066584_1some.host.org - - [03/May/2001:03:42:23 +0000] "GET /cgi-bin/test-cgi HTTP/1.1" 500 345WARNING : pattern(serverError) ==> 5xxWARNING : pattern(cgi) ==> test-cgiALERT : pattern(cgi) ==> class 'cgi': lvl=1.00 >= 1!DECODED :REQUEST : GET /cgi-bin/test-cgi HTTP/1.1HOST/USR: some.host.org - -STATUS : 500BYTES : 345METHOD : GETURL : /cgi-bin/test-cgiQUERY :VERSION : 1.1DATE : 03/May/2001:03:42:23 +0000-------------------------------------------

��3N;/7gsGO"Web IDS QN"@W?<N?9/KD$Fb@7^9#

Web IDS ��)��=.U!$kNT8r+O9k0K"122Z<8NXWeb 5<P<KP9k Web IDS N=

.YK"k5Wr4w/@5$#

webids.cfg =.U!$kOT8D=JF-9H&U!$kG"j"Web IDS ,T/7F$k

D-r+9?^$:9k3H,G-^9#

3N=.U!$kKO"Risk Manager Web IDS ,5]<H9k Web 5<P<QN;/7g

s,^^lF$^9#

U!$kbNQtO$s9H<kfK_j5lkNG"LoO=lirQ99k,WO"j^

;s#J<N;/7gsGO"U!$kbNQtrj9H7^9#

m: =.9k Web 5<P<N?$WK:v9k;/7gsrT87F/@5$#

TEC $+&�0��1�*��

Web IDS O wbindmsg Wm0i`rHQ7F"Q95l?aC;<8rh@7^9#

webids.cfg U!$kbN path_value Qia<?<O"3NWm0i`NLVrXj7^9#

path_value Qia<?<O"Web IDS N$s9H<k*hS;CH"CWfK"+0*K!

Nh&K_j5l^9#

path_value = path

33G path O"wbindmsg Wm0i`XN04$~Q9LVG9# wbindmsg Wm0i`O"Risk Manager EIF H&K$s9H<k5l^9#

1/��

FqQlJ0N@lU!$krHQ7F$klgO"National Language Service (NLS) NQ9

r_j7F"m1<kr_j9k,W,"j^9#GU)kHN NLS NQ9O"Web IDS

N$s9H<k*hS;CH"CW&Wm7<8c<KhCF+0*K_j5l^9#

nlsPath_value Qia<?<O"+0*K!Nh&K_j5l^9#

nls_Path_value = nlspath

128 P<8gs 3 jj<9 8

33G nlspath O"Web IDS NaC;<8&+?m0&U!$k webids.cat XN04$~

Q9LVG9#?H(P"nlsPath_value O!Nh&K_j5l^9#

nlsPath_value = x:¥webids¥%L¥%N.cat

3NH-"x: OIi$V8zG9#@lQt (%L) *hSaC;<8&+?m0&U!$k

>Qt (%N.cat) OBT~Krh5l^9#

%L H %N O"g8zGJ1lPJj^;s#

*�;*��

Web IDS O"Risk Manager EIF Perl $s?<U'<9rHQ7F Risk Manager 5<P<K

$YsHw.9klg" webids.cfg bN librmadPath_value Qia<?<KX"U1ilF

$kMrHQ7Fi$Vij<r+U1^9#3NQia<?<O"Web IDS N$s9H<

k*hS;CH"CW&Wm7<8c<KhCF+0*K_j5l^9#?H(P"Web IDS

, Windows K$s9H<k5lF$klgO"J<NQia<?<,_j5l^9#

librmad_value=1librmadPath_value=x:¥Program Files¥Tivoli¥RISKMGR¥bin

33G librmad_value=1 O"Web IDS ,=N$YsHr Risk Manager EIF Kwk3Hr

(7" librmadPath_value O"Risk Manager EIF H&K$s9H<k5l?,\Ni$V

ij<XNQ9rXj7F$^9#

sig.nefarious ��3<:��)��

Risk Manager N sig.nefarious U!$kO"Web 6bN70KAc<r]I7^9#Web

IDS O"3NU!$krHQ7F Web 5<P<rbK?<7"6b,J$+I&+r4Y^

9#sig.nefarious U!$kN\YKD$FO" 116Z<8NXsig.nefarious 70KAc<&

U!$kYr2H7F/@5$#

m: Risk Manager H&Ks!5lF$k*j8JkN sig.nefarious U!$kOT87J$

G/@5$#3NU!$kr3T<7">0rQ97F"=N3T<rT87F/@5

$#

webids.cfg =.U!$krT87F"m<I9k70KAc<&U!$kNQ9H>0rX

j7^9#?H(P"!Nh&K7^9#

signatureFilePath_value = Path¥SignaturesFileName

Path¥SignaturesFileName OJ<N$:l+G9#

¶ GU)kHN sig.nefarious U!$kN04$~Q9>HU!$k>#

¶ Risk Manager H&Ks!5lF$k sig.nefarious U!$kr3T<7">0rQ97

F+i"=N3T<rT89k3HKhCFH+Kn.7?70KAc<&U!$kXN

04$~Q9#J<Kcr(7^9#

signatureFilePath_value = g:¥webids¥sig.mysignatures

sig.nefarious 70KAc<&U!$kNG7P<8gsr@&sm<I9kKO"J<N

Tivoli Risk Manager N Web 5$Hr4w/@5$#

http://www.tivoli.com/support/secure_download_bridge.html


8.W

ebIn

trusio

nD

etection

��

*;9k^GN(i<NtrXj7^9#(i<HO"=|7?U)<^CHHlW7F$J

$"/;9&m0&U!$kN(sHj<rU#7^9#

exit_value = n

(i<uV,/87?i$D*;9kN+rXj9kKO"J<NM+i*r7^9#

0 *;7^;s#

1 1 s\N(i<NeK*;7^9#

n Xj7?stN(i< (=|7?U)<^CHHlW7J$"/;9&m0&U!$

kN(sHj<) NeK*;7^9#"/;9&m0&U!$kN(i<tO"

(2**53)-1 (= 9007199254740991) r6(k3HOG-^;s#

Web IDS ��G<bs^?O Windows NT 5<S9H7F)Ae2ilk>N Risk Manager "@W?<

HO[Jj"Web IDS O Perl 9/jWH&U!$krBT9k3HKhCF)Ae2^9#

Web IDS , Apache Web 5<P<rbK?<9kH-KO"Apache Web 5<P<,+0*

K Web IDS r)Ae2^9#

Windows �� Web IDS ��

Windows 79F`G Web IDS r+O9kKO"J<N=8rHQ7^9#

webids.bat [-etdvh -i input_file -c configuration_file]

*W7gsO=l>lJ<NH*jG9#

-e psr Windows Application Event Log ^?O Risk Manager EIF Kq-~_

^9#

-h Web IDS KX9kXkWpsr=(7^9#

-t "/;9&m0&U!$k+iN97rj"k?$`GT&3HrXj7^

9#

-d GPC0psrq-~_^9#Wm0i`O8`POK (STDOUT) q-~_

rT$^9,"=NeG3lrU!$kK>w9k3H,G-^9#

-v P<8gspsrPO7^9#

-i input_file "/;9&m0&U!$kN04$~Q9H>0rXj7^9#

-c configuration_file

=.U!$kN04$~Q9H>0rXj7^9#GU)kHOJ<NH*j

G9#

%RMADHOME%¥etc¥webids.cfg

?H(P"Windows 2000 G Web IDS r+O7"=lK Web 5<P<N"/;9&m0

(webserver.accesslog) rI_hi;"=NPOr TEC $YsH&m0&"@W?<Kw.9

kKO"J<NTr~O7^9#

webids.bat -e -i webserver.accesslog

130 P<8gs 3 jj<9 8

UNIX �� Web IDS ��

UNIX 79F`G Web IDS r+O9kKO"J<N=8rHQ7^9#

webids [-etdvh -i input_file -c configuration_file]

*W7gsO=l>lJ<NH*jG9#

-e psr syslog ^?O Risk Manager EIF Kq-~_^9#

-h Web IDS KX9kXkWpsr=(7^9#

-t "/;9&m0&U!$k+iN97rj"k?$`GT&3HrXj7^

9#

-d GPC0psrq-~_^9#Wm0i`O8`POK (STDOUT) q-~_

rT$^9,"=NeG3lrU!$kK>w9k3H,G-^9#

-v P<8gspsrPO7^9#

-i input_file "/;9&m0&U!$kN04$~Q9H>0rXj7^9#

-c configuration_file

=.U!$kN04$~Q9H>0rXj7^9#GU)kHOJ<NH*j

G9#

$RMADHOME/etc/webids.cfg

?H(P"UNIX G Web IDS r+O7"=lK Web 5<P<N"/;9&m0

(webserver.accesslog) rI_hi;"=NPOr TEC $YsH&m0&"@W?<Kw.9

kKO"J<NTr~O7^9#

webids -e -i webserver.accesslog

m: Unix 79F`G Web IDS rBT9k0K"Risk Manager ND-9/jWHK"J<N

Q9rIC7F/@5$#


Web ��Web IDS O"!:9k6b,h/NilF$kbN+I&+r(7^9#J<K"hj~^

l?psNcr(7^9#

956066584_1some.host.org - - [03/May/2001:03:42:23 +0000] "GET /cgi-bin/test-cgi

HTTP/1.1" 500 345WARNING : pattern(serverError) ==> 5xxWARNING : pattern(cgi) ==> test-cgiALERT : pattern(cgi) ==> class 'cgi': lvl=1.00 >= 1!DECODED :REQUEST : GET /cgi-bin/test-cgi HTTP/1.1HOST/USR: some.host.org - -STATUS : 500BYTES : 345METHOD : GETURL : /cgi-bin/test-cgiQUERY :VERSION : 1.1DATE : 03/May/2001:03:42:23 +0000-------------------------------------------


8.W

ebIn

trusio

nD

etection

Web IDS O""k[9H+iw.5l?Wa,6xHJCF"i<`,P5lkH"=N[

9H+iNWarhj~_^9#33Ghj~s@psreG,O7F"77$70KAc<

^?O70KAc<N/i9r70KAc<&G<?Y<9 (sig.nefarious U!$k) bG

jA9k+I&+hj9k3H,G-^9#

G<?Y<9bG!P5lJ$6bO"4/$U+lJ$^^KJCF7^&D=-,"j^

9#N1Y<9&79F`GO"G<?Y<9Nj|*J97,,WG9#

G7N/~!NrT&KO"7?K/+5l?6b*hS79F`Ne@r" sig.nefarious

U!$kbN70KAc<&j9HKIC7F/@5$#3N\*N?aK]}5lF$k;

-ejF#<DNNG<?Y<9rHQ7F"77$6brj|*K!$7"IW7F/@5

$#

J<K"=Nh&JG<?Y<9Ncr 2 D(7^9#

¶ Bugtraq Web 5$H: http://www.securityfocus.com

¶ Common Vulnerabilities Enumeration (CVE) N Web 5$H: http://www.cve.mitre.org

3Nhj~^l?psrjnHG,O7F"djrhN?aKHkY-"/7gsr=G7J

1lPJj^;s#

��3<:��*��sig.nefarious U!$kN(s8s&Q?<s&;/7gsKO"70KAc<N0k<W

(/i9) ,"j"3liOm0&(sHj<NU#<kIbG6b70KAc<NQ?<sr

57^9#1l"/;9OYpH7Fsp5l^9#

77$/i9rn.9k]KO"U#<kI>r/i9jANltH7FXj9k,W,"j

^9#

Web 6b70KAc<N/i9rIC^?O|n9kKO"J<Nh&K7^9#

1. sig.nefarious N ENGINE PATTERN ;/7gsK\j^9#

2. /i9rIC9k?aK"J<r3NU!$kKIC7^9#

a. [class=classname; field=fieldname; level1=count1;level2=count2; k=decay_param]

Qia<?<O=l>lJ<NH*jG9#

class=classname

Q?<s&(s8sbGXj5lF$k70KAc<NG->G9#

field=fieldname 70KAc<rM-go;J1lPJiJ$U#<kIG9#Q?<

s&(s8sN-zU#<kIO"host"method"url"status"query G

9#

level1=count1 \YO"136Z<8NXlYk&+&s?<N40Yr2H7F/@5

$#

level2=count2 \YO"136Z<8NXlYk&+&s?<N40Yr2H7F/@5

$#

k=decay_param \YO"137Z<8NX:j+&s?<N40Yr2H7F/@5$#

132 P<8gs 3 jj<9 8

,:77$70KAc<N/i9rb@9k3asHTrIC7F/@5$#F3as

HTO"]sI-f (#) G+O7J1lPJj^;s#

3. 70KAc<N{8N/i9r|n9kKO"|n9k70KAc<N/i9rjA7F

$kTro|7^9#

4. U!$kr]I7F/m<:7^9#

?H(P"!Nh&K7^9#

[class=directory; field=url; level1=2; level2=1; k=1000]# Some servers are sensitive to directory tricks like specifying /./# in the path name./\.\.//\.\

Web ��3<:��Web 6b70KAc<rIC^?O|n9kKO"J<Nh&K7^9#

1. sig.nefarious U!$krT87^9#

2. 3NU!$kN ENGINE PATTERN ;/7gsK\j^9#

3. ,ZJ/i9&;/7gsr+U1^9 (?H(P"[class=cgi; field=url;)#

4. J<N$:l+ 1 DrBT7^9#

a. !Nh&J 4 sN70KAc<TrIC7F"77$70KAc<rIC7^9#

# CVE-1999-0067, Bugtraq ID 629, input validation errorphf phf [CVE-1999-0067] CVE

77$70KAc<rb@9k3asHT (]sI-f (#) GO^j^9) rIC7F

/@5$#Bugtraq ID Vf (,+CF$klg)"CVE ID Vf (,+CF$klg)"

*hS70KAc<NJ1Jb@r~O7^9#

b. {8N Web 6b70KAc<r|n9kKO"|n9k70KAc<rjA7F$k

Tro|7^9#

5. U!$kr]I7F/m<:7^9#

��sig.nefarious U!$kNQ?<s&(s8s&;/7gsKO"m0&(sHj<NU#<

kIbG6b70KAc<r5970KAc<N0k<W (/i9) ,^^lF$^9#

^?"3N(s8sOm0&U!$kN(sHj<&U#<kIN$:l+KP7FYpd"

i<H,P5l?~KTolkUC*JkgF9HrBT7^9#?H(P"Ypd"i<H

,P5l?eO"6bru1d9$ cgi Wm0i`KP9kWa,5oK0;7F$k+I

&+rN'9k?aK"UC*JF9HrBT9k3H,G-^9#

=N?aKO"requires=class 0-rQ$FF9Hrkg7"\Y=7^9#3N0-O"

Web IDS ,3liNF9HrBT9k0K""i<HrP7?/i9rdjP7^9#-z

J/i9O"sig.nefarious U!$kNQ<5<&(s8s"*hSQ?<s&(s8sN;

/7gsK09k/i9G9#J<O=NcG9#

requires=pattern(cgi)requires=parser(suspiciousHexCodesUrl)requires=parser(suspiciousHexCodesQuery)


8.W

ebIn

trusio

nD

etection

requires=pattern(cgi)|pattern(directory)requires=(pattern(cgi)|pattern(directory))&(parser

(suspiciousHexCodesUrl)|parser(suspiciousHexCodesQuery))

classname O"/i9>NV<k0r(7^9#gLrHQ7FV<k0r0k<W=7^

9#requires=class 0-r~O9k]K-zJV<ki;RO!NH*jG9#

| := OR& := AND! := NOT

kgF9HrjA^?O\Y=9kKO"J<Nh&K7^9#


2. 3NU!$kN ENGINE PATTERN ;/7gsK\j^9#

3. J<N$:l+ 1 DrBT7^9#

a. !NU)<^CHK>CF"77$F9HNH_go;r 1 TKIC9k#

[class=classname; field=fieldname ; requires=class; level1=count1;level2=count2; k=decay_param]

,:3N77$/i9KD$Fb@9k3asHTrIC7F/@5$#F3asHT

O"]sI-f (#) G+O7J1lPJj^;s#

b. level1="level2="k= NMrIC^?OQ99k#\YKD$FO"136Z<8NX7

-$MH:jMN40Yr2H7F/@5$#

c. |n7?${8N70KAc<N/i9KX"9kTro|9k3HKhCF"=N/

i9r|n9k#

4. U!$kr]I7F/m<:7^9#

��5��"��.jG-J$T3J[9Hr1L9k3H,G-^9#[9H,T3JWarw.7F$kH

=G7?i" Web 5<P<N[9H>^?O IP "Il9r sig.nefarious U!$kKI

C7F/@5$#

Web IDS O[9H>r.8zGfS7^9#T3J(s8sbNWa*hS/i9>NfN

[9H>O"fS,Tolk0K.8zKQ95l^9#

a A z ^GN8z"0 A 9 ^GNtz"Tj*I (.)"*hS@C7e (-) N_rHQ7F

/@5$#

T3J[9HNj9HK IP "Il9rIC9kKO"!Nh&JTrIC7^9#

9.37.47.192 # suspicious host

"k$O"=N[9H>KP~9kTr!Nh&K.8zGIC7^9#

possible.attack.org # suspicious host

3NTO/i9&XC@<N<KIC7^9#U)<^CHO!NH*jG9#



134 P<8gs 3 jj<9 8

class= 3lO"suspicion (s8sGXj5l?T3J[9HNG->G9#

printLvl= u.9kWaN?$WrXj7^9#-zJWaN?$WO"

all"alerts"warnings G9#\YKD$FO"XT3J"/F#SF#<N?

$WNXjYr2H7F/@5$#

T3J[9Hr|n9kKO"sig.nefarious U!$krT87F"=N[9HN[9H>^

?O IP "Il9,^^lkTr|n7^9#

��-��-?*hS,O9kT3J"/F#SF#<N?$W ("i<H^?OYp"k$O=N>})

rXj9k3H,G-^9#



u.9kWaN?$WrQ99kKO"printLvl= KLNl]<H&lYkrXj7^9#-

zJl]<H&lYkO!NH*jG9#

all GiNYpNeN9YFNWa,sp5l^9#

warnings YpH"i<H,sp5l^9#

alerts "i<H@1,sp5l^9#

*��+��3<:��"��i|$s9H<kNe"iaF Web IDS r+O9kH-K"?tN$YsH,$YsH&3

s=<kK>w5lF$k3H,"j^9#3liN/~!N$YsHNJ+KO"6N"i

<`,^^lF$klg,"j^9#"k70KAc<,.jG-kbNG"kH=G7?l

gO"=N70KAc<rHi9H&(s8sKIC7F"6N"i<`Ntr:i93H,

G-^9#


[class=classname; field=fieldname; cancels=class]


class=classname

Hi9H&(s8sGXj5lF$k70KAc<&/i9NG->G9#

field=fieldname

70KAc<rM-go;J1lPJiJ$U#<kIG9#Hi9H&(s8sN

-zJU#<kIO"host" method" url" query G9#

cancels=class

Xj5l?/i9KlW9k70KAc<,!P5lkH"Yp^?O"i<HOs

p5l^;s (hjC5l^9)#hjC5lk/i9N-zJ-<o<IO"J<N

H*jG9#

all lW9k"i<HHYpr9YFhjC7^9#

engine_name(class_name)Xj5l?(s8s>*hS/i9>KlW9k"i<HHYprhjC7^

9#


8.W

ebIn

trusio

nD

etection

engine_name(class_name),engine_name(class_name)(s8s>H/i9>r 1 D:D=l>l3s^ (,) GhZC?j9HNf

G"=l>lN>0KlW9k"i<HHYprhjC7^9#

$/D+Ncr(7^9#

[class=trustedHosts; field=host; cancels=all]friendly\.computer\.org

[class=linuxDistr; field=url; cancels=pattern(cgi),pattern(file)]|\xlinus/mirro/linux

��Risk Manager Web IDS O"YpH"i<HH$&"2 DN?$WN"i<`rhL7F$^

9#YpO"i<HhjbEgY,c$bNH+J5l"Lo TEC $YsH&3s=<kK

sp5l^;s#18?$WNYp,ljNstJeP5lkH"=NYpO"i<HKQo

j^9#?H(P""koN Web 5<P<6bO"1lN[9H+i/.5l?'ZWa,

+jV7:T9kJI"18T3JWa,ljNstJeFk5lFO8aF"i<HKJj

^9#

J<N/i9&Qia<?<r409k3HKhCF"Yp,"i<HKJk^GN.5rX

j9kh&K Web IDS r=.9k3H,G-^9#

¶ level1

¶ level2

¶ k

u.5lk"i<H,?9.?j/J9.?j9klgO"/i9&Qia<?<r409k

3HrM87F/@5$#/i9&Qia<?<r409kKO"sig.nefarious U!$kf

N Web IDS Q<5<HQ?<s&(s8sN;/7gsrT87^9#

Web 6b70KAc<Npsr409kKO"J<Nh&K7^9#

1. sig.nefarious U!$krPC/"CW7^9#


3. U!$kN ENGINE PATTERN ;/7gsK\j^9#

4. level1="level2="k= NMr407F"lYk*hS:jpsr407^9#\YO"

XlYk&+&s?<N40Y^?O 137Z<8NX:j+&s?<N40Yr2H7F

/@5$#

5. 77$Mrb@9klgO"3asHTrIC7^9#F3asHTO"]sI-f (#)

GO^CF$J1lPJj^;s#

6. U!$kr]I7F/m<:7^9#

��76��

Risk Manager Web IDS O"1l?$WNT3JWaNtr"Xj7?7-$MlYkr6(

k^G+&sH7^9#7-$Mr6(kH"Web IDS O"i<Hr/T7^9#Xj*h

S40G-k7-$MlYkO"!NH*jG9#

level1=count1

1lNIa$sN1l$YsH&/i9&?$WNT3JWaNt# level1 MKO"

level2 NMJeNMrXj9k,W,"j^9#

136 P<8gs 3 jj<9 8

level2=count2

1lN[9HN1l$YsH&/i9&?$WNT3JWaNt#

HQ9k7-$MO"1lIa$s+1l[9H+KhCF[Jj^9#33GO"

www.austin.tivoli.com H$&[9H>rHQ7^9#

¶ Ia$sO level1 N7-$M tivoli.com rHQ7^9#

¶ [9H>N=N>Nt,O level2 N7-$M www *hS austin rHQ7^9#

level1 ^?O level2 NQia<?<Mr409kKO"7-$MrjA9k?aN Web IDS

ASCII F-9H&U!$k sig.nefarious U!$krT87^9#U!$krQ99kK

O"F-9H&(G#?<rHQ7^9#iaF3NU!$krT89klgO"T8rOa

k0K"*j8JkNU!$kN3T<rhCF/@5$#

��76��

Web IDS O"!P7?T3J$YsHNtr+&sH9k@1GO"j^;s#3lO"G

eNT3J$YsHNeK!P5lk5oJWabM8K~l^9#3N?aK"+&s?<

,:jXtH7F$sWjasH5lF$^9#

(:jXtO Risk Manager TEC Correlation GbHQ5l^9#3lO"7-$MrQ99k

3HKhCFV\*K409k3H,G-^9#)

T3JWa,'15lkH"P~9k:jXt Q NM, 1 D}(kH1~K"=l,!N

x0K>CF>A5l^9#

Q = Qn+ n11+2

- rk

F`*hSQia<?<O=l>lJ<NH*jG9#

Q(n) n s\NT3JWaNeN:jXtNM#

Q(n+1) 77$:jXtNM (n+1 s\NT3JWaNeNM)#

∆r GeNT3JWaNeKu.5l?5oJWaNt#

k :j(rXj7^9#

:jXtN0nKFA9kNO"2 DNQia<?< ∆r H k G9#

¶ 5oJWaNt (∆r) ,g-1lPg-$[I":jXtNMO.5/Jj^9#3N0

nO"1l[9H+i5oJWa,?tu.5lkH"?H(3N[9H,anKT3J

Warw.7F$?H7Fb"=N[9HrT3J[9HHO+J5J$h&K9k3H

r[j7F$^9#

¶ :jQia<?< (k) ,.51lP.5$[I"5oJ$YsH,u.5lk]N:jX

tNMOhj./:/7^9#3NQia<?<KhCF"anNT3J$YsHruC

9k.YrXjG-^9#

?H(P"k=100 G"klg"100 DN5oJWa,u.5lkH":jXt Q NMO

2 ,N 1 KJj^9#


8.W

ebIn

trusio

nD

etection

:jXtN0nO"sig.nefarious U!$kbN/i9&XC@<TK"k k :jQia<

?<r4a9k3HKhCF40G-^9#

138 P<8gs 3 jj<9 8

Cisco Secure IDS ��

3NOKO"J<Nps,^^lF$^9#

¶ X5WY

¶ 141Z<8NXTEC CorrelationY

¶ 33Z<8NXRisk Manager N$s9H<kY

¶ 143Z<8NXTEC ?9/Y

Cisco Secure IDS 6b70KAc<Nj9HKD$FO"289Z<8NXCisco Secure IDS 6

b70KAc<Yr2H7F/@5$#

Cisco Secure IDS aC;<8Nj9HKD$FO"259Z<8NXCisco Secure IDS NaC;

<8Yr2H7F/@5$#

��Risk Manager KO"Adapter for Cisco Secure IDS ,^^lF$^9#3lO"Cisco Secure

Intrusion Detection System (Cisco Secure IDS H7FbNilF$^9) KhCF8.5l?

$YsHr Tivoli Enterprise Console (TEC) N$YsHK^CW7^9#$YsHO"J<N

Cisco Secure IDS ;s5<+ihj~`3H,G-^9#

Cisco Secure IDS 4210 ;s5<

3N;s5<O"MCHo</r#G9k$5'N"/F#SF#<r!P9k"M

CHo</&;-ejF#<!oG9#3lO"45Mbps D-r5]<H7F$^

9#

Cisco Secure IDS 4230 ;s5<

3N;s5<O"MCHo</r#G9k$5'N"/F#SF#<r!P9k"M

CHo</&;-ejF#<!oG9#3lO"100Mbps D-r5]<H7F$^

9#

Cisco Catalyst 6000 U!_j<N/~!Nb8e<k

Cisco Catalyst 6000 IDS Module O"Cisco Catalyst 6000 b.ZjX(!oK$s9

H<k9k3HNG-k=UH&'"&3s]<MsHG9#3Nb8e<kO"Z

jX(!=H;-ejF#<!=r1lN!oK}g9k3HKhj"$5'N-U

r}C?"/F#SF#<N6b!PrT$^9#

Cisco Secure IDS QN Risk Manager "@W?<O"J<N*Zl<F#s0&79F`G5

]<H5lF$^9#

¶ 129 MB JeNabj<rk\7? Service Pack 6.0 rHQ9k Windows NT 4.0

¶ 128 MB JeNabj<rk\7? 500 MHz Wm;C5<rHQ9k Windows 2000

9


9.C

iscoS

ecure

IDS

��

��

�

¶ 128 MB JeNabj<rk\7? Sun Solaris 2.6"2.7"*hS 2.8

v Solaris libCrun QCA

v Solaris 2.6 QCA # 105591-09

v Solaris 2.7 QCA # 106327-08

v Solaris 2.8 QCA # 108434-01

m: QCAr$s9H<k7F+i"Cisco SDK r$s9H<k9k0K"^7srjV

<H9k,W,"j^9#

¶ Linux (Intel) Kernel 2.2.16"Libc 6"*hS 128 MB JeNabj<

¶ Cisco Secure IDS KO"m.s0*hSG<?Y<9&9Hl<8QK"1 GB NG#9

/&9Z<9rN]9k3Hr*+a7^9#

¶ QU)<^s9eN}3Khj";s5<H3s=<kO=l>lLN3sTe<?<K

$s9H<k9k,W,"j^9#

Cisco Secure IDS NI-easF<7gsO"!N Web 5$H+i~j9k3H,G-^

9#

http://www.cisco.com

&��Cisco Secure /~!N79F` (J0N NetRanger) O"MCHo</K*1k5vD"/F

#SF#<r!P7"sp7"*;5;kh&_W5l?"kH,ONj"k?$`/~!N

79F`G9# Cisco Secure IDS QN"@W?<O"+RNMCHo</,bt=<9^?

O0t=<9+iN6bru1F$k+I&+rNk,WN"kkHGHQ5l^9# Cisco

Secure IDS QN"@W?<KO"J<Nh&Jbe`3s]<MsH,^^lF$^9#

¶ ;s5< - MCHo</r5N7"IP MCHo</&HiU#C/rh}7F"EWJ

;-ejF#<&$YsHr Director K>w9kMCHo</uV#

^ 19. Cisco Secure IDS QN"@W?<N^

140 P<8gs 3 jj<9 8

¶ G#l/?< - 1 D^?O#tN;s5<rbK?<7F",6MCHo</VN;-e

jF#<rI}9kf{3s=<k#

¶ ]j7<&^M<8c< - b& 1 DN3s=<k=.#

¶ ]9H&*U#9 - WmWi(?j<\3Y<9NWmH3krHQ9k Cisco Secure

IDS ^?O NetRanger 5<S9NL.eNr@#

TEC CorrelationCisco Secure IDS O"MCHo</eN"/F#SF#<rbK?<7"=lr=[5lk6

bN{NNQ?<s&70KAc< HM-go;^9# Cisco Secure IDS ;s5<OlW9

kbNr+U1kH"79F`&m0KaC;<8rq-~_^9#Cisco Secure IDS QN

Risk Manager "@W?<O"=.U!$krHQ7F"=N$YsHr$YsH&5<P<

Kw.7^9#

Risk Manager O Cisco Secure IDS $YsHH">N?$WN;s5<+iu1hC?=N>

N$YsHNjXr4Y" Risk Manager "I_K9Hl<?<,/~!N$YsH4NrD

.G-kh&K7^9#

Cisco Secure IDS ��Cisco Secure IDS QN"@W?<O"HQ7F$k79F`NG-N$s9H<k}!rHQ

7F$s9H<k9k3H,G-^9#$s9H<kNjgKD$FO"39Z<8NXG-N

$s9H<kKhk Risk Manager 3s]<MsHN$s9H<kYr2H7F/@5$#

m: Unix 79F`K Cisco Secure IDS QN Risk Manager r=.9k0K"Risk Manager

ND-9/jWHK"J<NQ9rIC7F/@5$#


Unix *hS Linux G"Cisco Secure IDS QN"@W?<,HQ9k Cisco Secure IDS

DataFeed 3s]<MsHr$s9H<k9kH"79F`eK*<Ws&Q9o<Ir}D

″netrangr″ f<6<&"+&sH,n.5l^9# Cisco Secure IDS QN"@W?<r$s

9H<k7?eKO""I_K9Hl<?<NQ9o<IrHQ7F"3N"+&sHr]n

9k3Hr*+a7^9#

Risk Manager EIF �� Cisco Secure IDS ��

Cisco Secure IDS QN"@W?<NGU)kHN=.GO"Cisco Secure IDS N$YsHO

Risk Manager EIF Kw.5l"!K"3N Risk Manager EIF , Cisco Secure IDS N$Ys

Hr Risk Manager 5<P<Kw.7^9# Cisco Secure IDS N$YsHr Risk Manager

TEC N$YsHK,ZK^CTs09kKO" Cisco Secure IDS QN"@W?<NU!$k

rHQ9kh& Risk Manager EIF r+9?^$:9k,W,"j^9#

Cisco Secure IDS N$YsHr^CW9kh&K Risk Manager EIF r=.9kKO"

csids.fmt U!$kr Risk Manager EIF N rmad.fmt U)<^CH&U!$kNGeKIC

7^9#ICeN rmad.fmt U!$krHQ7F"/i9jA9F<HasH&U!$k

(.cds) r=.7^9# rmad.cds U!$kr=.9kKO"J<N9FCWrBT7^9#

1. csids.fmt r rmad.fmt U!$kNGeKIC7^9#

Windows 79F`Nlg:

cat csids.fmt >> rmad.fmt


9.C

iscoS

ecure

IDS

��

��

�

UNIX 79F`Nlg:

cp csids.fmt >> rmad.fmt

Windows *hS Unix NIAiN79F`Nlgb"Risk Manager EIF O csids.fmt U

!$krHQ7^9#

2. riskmgr_gencds 3^sIrBT7F".cds U!$krFn.7^9#


3. 975l? rmad.cds U!$kr"Cisco Secure IDS QN"@W?<,$s9H<k5l

F$k79F`KF[V7^9#

Cisco Secure IDS Q"@W?<GHQ9k?aK""@W?<=.!=rHQ7F rmad.cds

r979k}!N\YKD$FO" 49Z<8NXACF rHQ7? Risk Manager "@W?<

N=.*hS[[Yr2H7F/@5$#

Cisco Secure IDS DataFeed '��(��Cisco Secure IDS ��

J<N9FCWrBT7F"Cisco Secure IDS QN"@W?<KP7F Cisco Secure IDS

DataFeed 3s]<MsHr=.7^9# csidsDataFeed 3s]<MsHO"Cisco Secure IDS

QN"@W?<H3N;s5<NVNL.$s?<U'<9G9#

Cisco Secure IDS ;s5<N=.O",:m<+k&3s]<MsHr=.9k0KToJ1

lPJj^;s#

1. csidsDataFeed 3^sIGHQ9k;s5<N IP HICpsrhj7^9#3NpsO

9GK;s5<K=.5lF$kO:G9#psO"Director ^?O Policy Manager N$

:l+N;s5<=.D<k+ih@9k3H,G-^9#

2. !Nh&K7F csidsDataFeed 3^sIrBT7";s5<N[9HKX9kpsrX

j7^9#

csidsDataFeed cfg_remote add-ip IP_Address[-po po_number][-on orgname][-oi orgnumber]]-hn host_name][-hi n][-hb nnn]

3. !Nh&K7F csidsDataFeed 3^sIrBT7"m<+k&"@W?<N[9HKX

9kpsrXj7^9#

csidsDataFeed cfg_local update[-po po_number][-on orgname][-oi orgnumber]]-hn host_name][-hi n]

ACF rHQ9kH"Risk Manager 5<P<+iU!$kr=.9k3H,G-^9#=Nb

@KD$FO"49Z<8NXACF rHQ7? Risk Manager "@W?<N=.*hS[[Y

r2H7F/@5$#

142 P<8gs 3 jj<9 8

��>3��3N;/7gsGO Tivoli "I_K9Hl<?<,"Cisco Secure IDS QN Risk Manager

"@W?<KP7FBT9k?9/rb@7^9#

Cisco Secure IDS ��=.,0;7?i"Risk Manager TEC ?9/rHQ7F Cisco Secure IDS QN"@W?<

r+O7^9#XCisco Secure IDS "@W?<N+OYNb@r2H9k+""k$Oj0G

"@W?<r+O9klgO"!NH*j~O7F/@5$#

Linux 79F`Nlg:

/etc/rc.d/init.d rma_csids-init start

Solaris 79F`Nlg:

/etc/init.d/rma_csids-init start

Windows 79F`Nlg:

netstart rma_csids

Cisco Secure IDS ��79F`,FO09kH"Risk Manager O"oK"Cisco Secure IDS QN"@W?<rG<

bsH7F+O9kh&K;CH"CW7^9# Cisco Secure IDS QN"@W?<rj0G

d_9kKO"!Nh&K~O7^9#

Linux 79F`Nlg:

/etc/rc.d/init.d rma_csids-init stop

Solaris 79F`Nlg:

/etc/init.d/rma_csids-init stop

Windows 79F`Nlg:

net stop rma_csids

TEC ��Risk Manager KO"Tasks for Enterprise Risk Management H$&H+N?9/&i$Vij

<,"j^9#Risk Manager O"3N?9/&i$Vij<r"TEC-Region H$&GU)k

HN TEC ]j7<&j<8gsK$s9H<k7^9#TEC ?9/rBT9k0K",

:""@W?<r(sI]$sHeK$s9H<k7F/@5$#

Risk Manager O"Cisco Secure IDS Q"@W?<KP7FJ<N TEC ?9/rs!7^

9#

¶ Start_Cisco_Secure_IDS_Adapter

¶ Stop_Cisco_Secure_IDS_Adapter

¶ Configure_Cisco_Datafeed

Cisco Secure IDS ��Cisco Secure IDS QN"@W?<r+O9kKO"Risk Manager TEC ?9/rHQ9k3H

,G-^9#


9.C

iscoS

ecure

IDS

��

��

�

TEC ?9/rHQ7F Cisco Secure IDS QN"@W?<r+O9kKO"J<Nh&K7^

9#

1. Tivoli G9/HCWG"Tasks for Enterprise Risk Management H$&iYkNU$

? TEC ?9/&i$Vij<r/jC/7^9#

2. Start_Cisco_Secure_IDS_Adapter TEC ?9/r/jC/7^9#

Cisco Secure IDS ��Cisco Secure IDS QN"@W?<rd_9kKO"Risk Manager TEC ?9/rHQ9k3H

,G-^9#

TEC ?9/rHQ7F Cisco Secure IDS QN"@W?<rd_9kKO"J<Nh&K7^

9#



2. Stop_Cisco_Secure_IDS_Adapter TEC ?9/r/jC/7^9#

Cisco Secure IDS DataFeed ��3N?9/O";s5<H Cisco Secure IDS QN Risk Manager "@W?<HNVNL.r

;CH"CW7^9#TEC ?9/rBT9k0K",:""@W?<r(sI]$sHeK

$s9H<k7F/@5$#

TEC ?9/rHQ7F Cisco Secure IDS QN"@W?<K DataFeed r=.9kKO"!N

h&K7^9#



2. Configure_Cisco_DataFeed TEC ?9/r/jC/7^9#

Cisco Secure IDS ��9*��"@W?<KVP9&(i<WaC;<8^?O\3X"N(i<,=(5l?lgO"J<

N3^sIrHQ7F"=N(i<r/j"7F/@5$#

Unix �� Linux ��:% cd $NETRANGER/bin% csidsDataFeed stop% removeSemas

JeN3^sIrBT7?eG"J<N3^sIrHQ7F" %NETRANGER%/tmp *hS

%NETRANGER%/tmp/queues G#l/Hj<bNU!$kr9YFo|7^9#

% cd $NETRANGER/tmp% rm *.*% cd queues% rm *.*

Windows ��:% cd %NETRANGER%¥bin% csidsDataFeed stop% cd %NETRANGER%¥tmp

144 P<8gs 3 jj<9 8

JeN3^sIrBT7?eG"J<N3^sIrHQ7F" %NETRANGER%¥tmp *hS

%NETRANGER%¥tmp¥queues G#l/Hj<bNU!$kr9YFo|7^9#

% del *.*% cd queues% del *.*


9.C

iscoS

ecure

IDS

��

��

�

146 P<8gs 3 jj<9 8

ISS RealSecure ��


¶ X5WY


¶ 149Z<8NXSNMP HiCWY

¶ 149Z<8NXISS RealSecure Q"@W?<N$s9H<k*hS=.Y

¶ 152Z<8NXISS RealSecure Q"@W?<NI}Y

Internet Security Systems RealSecure (ISS RealSecure) N6b70KAc<Nj9HKD$F

O"297Z<8NXISS RealSecure 6b70KAc<Yr2H7F/@5$#

SNMP "@W?<N\YKD$FO"VTivoli Enterprise Console "@W?<&,$IWN

10 Or2H7F/@5$#

ISS RealSecure =JKX9kpsO"!N Web 5$H+i~j9k3H,G-^9#

http://www.iss.net

��Internet Security Systems (ISS) O"}g5l?/~!NWiCHU)<`G"k ISS

RealSecure rs!7^9# ISS RealSecure O8`"Wm<ArHQ7F"MCHo</&H

iU#C/H[9H&m0&(sHj<r"{NN6ba=CI^?O=[5lk6ba=C

IHfS7^9# ISS RealSecure O"?/NMCHo</*hS79F`I}"Wj1<7

gsH}g9k3H,G-^9#

ISS RealSecure P<8gs 5.5 ^?O 6.0 ;s5<O"MCHo</&Y<9N6bd79

F`&(<8'sHN6br!P9kH"SNMP HiCWrw.7^9#3liN SNMP H

iCW, Windows 79F`^?O UNIX 79F`K>\w.5lkh&K"ISS RealSecure

r=.9k3H,G-^9#w.hN79F`OLo Tivoli ^?O Tivoli J0ND-N(s

I]$sHeK"j"=3G Tivoli SNMP "@W?<rBT7F$^9#

ISS RealSecure QN Risk Manager O"Tivoli SNMP "@W?<r=.9kU!$k+i.

j"3lKhj ISS RealSecure $YsHrhj~_$YsH&5<P<K>w7FjXrT

$^9#U!$kO!NH*jG9#

¶ tecad_snmp.cds

¶ tecad_snmp.oid

10


10.IS

SR

ealSecu

re��

��

�

ISS RealSecure Q"@W?<NU!$kO"TEC SNMP "@W?<N"k(sI]$sHK

"j^9#

!N^O"ISS RealSecure QN Risk Manager "@W?<H$YsH&5<P<VNbe`N

X8r(7F$^9#

&��ISS RealSecure bK?<&Qia<?<O"?MJMCHo</uVdU#<Ac<&3s]

<MsHKgo;F409k3H,G-^9#3liNQia<?<rf{3s=<k+i=

.9k3H,G-^9#

ISS RealSecure =JKOJ<Nb8e<k,"j^9#

^ 20. ISS RealSecure Q"@W?<N^

148 P<8gs 3 jj<9 8

¶ MCHo</&Q1CHr}89k(s8s

¶ 1 D^?O#tN(s8srbK?<9k^M<8c<

¶ 79F`&m0rbK?<9k79F`&(<8'sH

GbNQU)<^s9rB=9k?aKO"F(s8s4HKlQ3sTe<?<rHQ7"

1 fNf{3sTe<?<G^M<8c<rBT7F/@5$#

Tivoli Risk Manager 5<P< 3.8 $s9H<k&QC1<8KO" SNMP "@W?<r

=.7F ISS RealSecure "i<`r Tivoli Enterprise Console (TEC) $YsHK^CW9k

?aKHQ9k" Risk Manager .cds"*hS .oid =.U!$k,^^lF$^9#U!$k

O!NljK$s9H<k5l^9#

$BINDIR/../generic_unix/RISKMGR/ACF_REP/tecad_snmp.cds$BINDIR/../generic_unix/RISKMGR/ACF_REP/tecad_snmp.oid


SNMP *+�Risk Manager N tecad_snmp.cds U!$krHQ7F SNMP "@W?<r=.9kH"

SNMP "@W?<O SNMP HiCWN!N 2 DN+F4j<r!P7^9#3liN6b

O"ISS RealSecure ;s5<NMCHo</&(<8'sH,bK?<7^9#

¶ MCHo</&Y<9N6b

MCHo</KP7FC(ilk6b#

297Z<8NXMCHo</6b70KAc<YO"=_ Risk Manager Khj5]<H5

lkMCHo</&Y<9N6bKD$FN ISS RealSecure SNMP $YsHr(7^

9#

¶ 5<P<&(<8'sH6b

MCHo</GOJ/"D9N[9HK~1FC(ilk6b#

299Z<8NX79F`6b70KAc<YO"=_ Risk Manager Khj5]<H5lk

79F`&(<8'sH6bKD$FN ISS RealSecure SNMP $YsHr(7^9#

TEC CorrelationTEC SNMP "@W?<O"Windows NT eGBT7F$k ISS RealSecure Management

Console +iw.5lk SNMP HiCWr'17^9#SNMP "@W?<,3liN SNMP

$YsHr TEC $YsHK^CW9kH" TEC $YsHO$YsH&5<P<Kw.5l

F"X"U1,Tol^9#

ISS RealSecure ��$s9H<kN}!KD$FO"33Z<8NXRisk Manager N$s9H<kYr2H7F/

@5$#

ISS RealSecure ��/~!N$YsHr SNMP $YsHH7Fw.9kh&K ISS RealSecure ;s5<r=.

9k3H,G-^9#ISS RealSecure ;s5<r=.9kKO"]j7<&U!$kr+9?

^$:7"$YsHQYr_j7^9#


10.IS

SR

ealSecu

re��

��

�

m: UNIX 79F`G ISS RealSecure QN Risk Manager "@W?<r=.9k0K" Risk

Manager D-9/jWHK!NQ9rXj7F/@5$#


ISS RealSecure r=N$s9H<kljG=.7?j"^?O=N=.U!$krT87"

Tivoli Adapter Configuration Facility (ACF) rHQ7F:v9kU)<^CH&U!$kr[

[*hS,Q9k3H,G-^9#\YO"49Z<8NXACF rHQ7? Risk Manager "

@W?<N=.*hS[[Yr2H7F/@5$#

1. ,WK~8F"ISS RealSecure Q"@W?<N/i9jA9F<HasH (.cds) U!$k

tecad_snmp.cds rT87^9# ISS RealSecure Q"@W?<O"3NU!$kbNTW

J(sHj<r*r7F3asH=9k3HKhCF409k3H,G-^9#

2. tecad_snmp.cds *hS tecad_snmp.oid U!$kr,Q7F"Tivoli Management

Enterprise (TME) "@W?<r=.7^9#

��ISS RealSecure N+9?^$:D=J]j7<&U!$kKhj"HQD=J IDS 70KA

c<HHQT=J IDS 70KAc<rXj9k3H,G-^9#^?"F70KAc<Nl

WKP9k79F`N?~b1L7^9#ISS RealSecure ]j7<&(G#?<rHQ7F"

7,N]j7<Nn.^?O{8]j7<N97rT$^9#3lKhj"$YsH&G<?

Y<9 (logdb) K-?9k70KAc<rXj7^9#3s=<kN ISS RealSecure $Ys

H&G<?Y<9K]I5lk$YsHO"ISS RealSecure QN"@W?<,h}9k$Ys

HKBil^9#

!P!=rn.7"IP "Il9r ISS RealSecure Q"@W?<N IP "Il9K_j9k}

!KD$FO"ISS RealSecure qAr2H7F/@5$#^?"ISS RealSecure Q"@W?<

N tecad_snmp.cds U!$kKhCF5]<H5lkF$YsH4HK"~zr TEC SNMP

"@W?< (HiCWu.&) N IP "Il9K_j9k}!KD$FNb@b2H7F/@

5$#

��F ISS RealSecure !P!=4HK"!P!=Nm0K]I5lk$YsH,3s=<kN$

YsH&G<?Y<9K>w5lkQYrGg=7F/@5$#QYrGg=9k3HKhC

F"TEC $YsH&3s=<kK*1k$YsHNj"k?$`-?,~15l^9#

QYrGg=9k}!KD$FO"ISS RealSecure NqAr2H7F/@5$#d)5lk_

jO"1 DNm0K]I5lkGg-?t, 5000"G<?Y<91|be`@, 1%"5i

K0*G<?Y<9&"CWm<IN*rG9#

TEC SNMP ��Risk Manager KO"5]<H5lkWiCHU)<`NU!$krHQ7F" TEC SNMP

"@W?<&U!$k (tecad_snmp.cds *hS tecad_snmp.oid) r979k?aNWmU!

$k,s!5lF$^9#

ISS RealSecure Q SNMP WmU!$krBT9k0K"TEC SNMP "@W?<&U!$k

NPC/"CW&3T<rn.7F/@5$#3NWmU!$kO SNMP "@W?<rd_

7"(sI]$sHeN TEC U!$kr ISS RealSecure ,s!9kU!$kKV-9(

F" SNMP "@W?<rFO07^9#

150 P<8gs 3 jj<9 8

J<N9FCWK>CF"TEC SNMP "@W?<, ISS RealSecure "i<`r Risk

Manager K>w9kh&K=.7^9#

1. "I_K9Hl<?<N TME G9/HCWG"GU)kHN TEC Nhr(9

VTEC-Region (TEC Nh)W"$3sr@Vk/jC/7^9#


k&^M<8c<)W&#sI&r=(7^9#

3. VSNMP Adapter for ISS RealSecure (ISS RealSecure Q SNMP "@W?<)W"$3sr@Vk/jC/7F"VAdapter Configuration Profile ("@W?<=.WmU!$

k)W&#sI&r*<Ws7^9#

4. VAdd Entry ((sHj<NIC)Wr/jC/7^9#

5. "@W?<&?$WK:v9k tecad_snmp r*r7"VSelect & Close (*r & /m<:)Wr/jC/7^9#

6. VEdit Adapter Configuration ("@W?<=.NT8)W&#sI&G"VDistribution ([[)Wr/jC/7F"U!$kN[[j9Hr=(7^9#

GU)kHN[[Q9O"Risk Manager ,s!9k SNMP U!$kGOJ/"TEC

SNMP U!$krX7F$^9#[[=<9r Risk Manager P<8gsrX9h&KQ

99k}!"^? TEC P<8gsH Risk Manager P<8gsr^<89k}!KD$

FO"Tivoli qAr2H7F/@5$#

,:"[[j9HK"Risk Manager ,s!9k tecad_snmp.cds *hS tecad_snmp.oid

U!$k"^?O Risk Manager U!$kH^<85l?U!$kr~lF/@5$#

7. B]NU!$k*hSQ9rT89kKO"!Nh&K7^9#

¶ [[9kU!$kN>0r@Vk/jC/7^9#

¶ yf (=) N#K"kU)k@<&\?sr/jC/7FQ9r_j7^9#Q9O!

Nh&KJj^9#

$BINDIR/../generic_unix/RISKMGR/ACF_REP/


8. Q9N_jr]I9klgO"A'C/^</r*r7^9#

9. VSave & Close (]I & /m<:)Wr/jC/7^9#

UNIX �� Tivoli �� SNMP ��&+�+�ISS RealSecure Q"@W?<H Cisco k<?<Q"@W?<OIAib Tivoli SNMP "@W

?<rHQ7^9#ISS RealSecure Q"@W?<r{K;CH"CW7F"klgO" Cisco

k<?<Q"@W?<KD$F3Njgr+jV9,WO"j^;s#

Tivoli SNMP "@W?<N$s9H<k}!N04Jb@O"VTivoli Enterprise Console "

@W?<&,$IWr2H7F/@5$#=NeG"4HQN*Zl<F#s0&79F`,

Q1CHr TEC $YsH&5<P<KP)XjG-k3HrN'7F/@5$#

Tivoli J0ND-G SNMP "@W?<r;CH"CW9kKO"J<Nh&K7^9#


10.IS

SR

ealSecu

re��

��

�

1. SNMP "@W?<r$s9H<k7^9#?H(P"packadd rHQ7F" SNMP "@

W?<r Solaris 79F`N /test/riskmgr/snmp/ G#l/Hj<K$s9H<k7^

9# 42Z<8NXSolaris 79F`K*1k"@W?<N$s9H<kYr2H7F/@

5$#

2. SNMP "@W?<r$s9H<k7?G#l/Hj<K\07^9#

cd /test/riskmgr/snmp/etc

3. tecad_snmp.conf =.U!$krT87" ServerLocation r^`Tr57^9#

4. 3NTr!Nh&KQ97^9#

ServerLocation=1.2.3.4

1.2.3.4 O"TEC $YsH&5<P<N IP "Il9r(7^9#

5. $YsH&5<P<, Windows NT 79F`G"klgd" Tivoli J0N SNMP "@

W?<rHQ7F$klgO"!NTbIC7^9#

ServerPort=5529

6. SNMP HiCWru.9kh&K"/etc/services U!$kbN!N(sHj<rQ97

^9# /etc/services U!$kK!NTrIC7^9#

snmp-trap 162/tcpsnmp-trap 162/udp

7. TEC $YsH&5<P<N tecad_snmp.cds U!$k*hS tecad_snmp.oid U!$k

r"T8*hSF9H,Qs@ Risk Manager ,s!9kU!$kHV-9(^9#

ISS RealSecure ��Tivoli "I_K9Hl<?<O"ISS RealSecure Q"@W?<KD$F"3N;/7gsGb

@9knHrBT7^9#

SNMP ��ISS RealSecure Q"@W?<H Cisco k<?<Q"@W?<OIAib Tivoli SNMP "@W

?<rHQ7^9#ISS RealSecure Q SNMP "@W?<r+O9klgO" Cisco k<?<

QN SNMP "@W?<b+O9k3HKJj^9#

Tivoli SNMP "@W?<&=UH&'"r$s9H<k7?G#l/Hj<K\07^9#W

iCHU)<`LNGU)kHNLVO!NH*jG9#

Windows 79F`:

%LCFROOT%¥bin¥w32-ix86¥tme¥tec¥adapters¥bin¥net start tecsnmpadapter

Windows NT NlgO"V3sHm<k QMkWrHQ7F SNMP "@W?<r+O9k

3HbG-^9#

AIX:

$LCFROOT/bin/aix4-r1/TME/TEC/adapters/bin/init.tecad_snmp start

Solaris:

$LCFROOT/bin/solaris2/TME/TEC/adapters/bin/init.tecad_snmp start

152 P<8gs 3 jj<9 8


?<rHQ7^9# ISS RealSecure Q SNMP "@W?<rd_9klgO" Cisco k<?

<QN SNMP "@W?<bd_9k3HKJj^9#

Tivoli SNMP "@W?<&=UH&'"r$s9H<k7?G#l/Hj<K\07^9#W

iCHU)<`LNGU)kHNLVO!NH*jG9#

Windows 79F`:

%LCFROOT%¥bin¥w32-ix86¥tme¥tec¥adapters¥bin¥net stop tecsnmpadapter

AIX 79F`:

$LCFROOT/bin/aix4-r1/TME/TEC/adapters/bin/init.tecad_snmp stop

Solaris 79F`:

$LCFROOT/bin/solaris2/TME/TEC/adapters/bin/init.tecad_snmp stop


10.IS

SR

ealSecu

re��

��

�

154 P<8gs 3 jj<9 8

Cisco ��


¶ XCisco k<?<N5WY


¶ 157Z<8NXCisco k<?<Q"@W?<N$s9H<kY

¶ 160Z<8NXCisco k<?<NI}Y

¶ 161Z<8NXCisco k<?<NHiCWY

Cisco k<?<NHiCWKX9kqAO"Cisco N Web 5$HK"j^9# MIB"HiC

W"OID"*hS=N>NpsKD$FO"!N Cisco Web 5$Hr2H7F/@5$#


^?"VTivoli Enterprise Console "@W?<&,$IWN SNMP "@W?<KX9kOb2

H7F/@5$#

Cisco ��Cisco k<?<OHiCWr!P7F SNMP $YsHr8.7^9#SNMP $YsHO"

Windows 79F`^?O UNIX 79F`N$:l+K>\w.9k3H,G-^9#w.h

N79F`OLo Tivoli ^?O Tivoli J0ND-N(sI]$sHeK"j"=3G Tivoli

SNMP "@W?<rBT7F$^9#

Cisco k<?<QN Risk Manager O"Tivoli SNMP "@W?<r=.9kU!$k+i.

j"3lKhj Cisco k<?<&$YsHrhj~_$YsH&5<P<K>w7FjXr

T$^9#U!$kO!NH*jG9#

¶ tecad_snmp.cds

¶ tecad_snmp.oid

Cisco k<?<Q"@W?<NU!$kO"TEC SNMP "@W?<,"k(sI]$sHK

"j^9#

11


11.C

isco�

��

��

�

TEC CorrelationTivoli Enterprise Console (TEC) SNMP "@W?<O Cisco k<?<KhCFw.5lk

SNMP HiCWr'17F"=liN SNMP $YsHr TEC $YsHK^CW7^9#

SNMP "@W?<O TEC $YsHr$YsH&5<P<Kw.7F"X"U1rT$^9#

Risk Manager O Cisco k<?<&$YsHr">N?$WN;s5<+iw.5lk=N>

N$YsHHX"U1"Risk Manager "I_K9Hl<?<,/~!N$YsH4NrD.

G-kh&K7^9#

SNMP X"/i9O" sensor_abstract.baroc U!$k*hS riskmgr.baroc U!$kN

/i9KhCF[Jj^9#crouter_snmp.baroc U!$kKO Cisco k<?<QN/i9N

I8*,^^lF$^9#

^ 21. Cisco k<?<Q"@W?<N^

156 P<8gs 3 jj<9 8

Cisco ��Tivoli Risk Manager 3.8 $s9H<k&QC1<8KO" Cisco k<?<Q"@W?<G

"@W?<=.!= (ACF) rHQD=J$s9H<k&5]<H,^^lF$^9#3NQ

C1<8KO"Cisco k<?<Q"@W?<N crouter_snmp.baroc U!$k"jXk<k"

*hS prolog U!$kb^^lF$^9#5iK"TEC SNMP "@W?<r=.9k?a

N/i9jA9F<HasH (.cds) *hS .oid U!$kb^^lF$^9#$s9H<k

e"U!$kO!NG#l/Hj<KV+l^9#

$BINDIR/../generic_unix/RISKMGR/ACF_REP/tecad_snmp.cds$BINDIR/../generic_unix/RISKMGR/ACF_REP/tecad_snmp.oid


HiCW+NKHiCWN8.5lk~oO^^l^;s#^?"SNMP "@W?<KO?

$`&9?sWrh@9k?aN$s?<U'<9,"j^;s#\7/O"VTivoli

Enterprise Console "@W?<&,$IWr2H7F/@5$#

��$s9H<kN0K"VTivoli Risk Manager jj<9&N<HWr2H7F"=UH&'"

WoKX9kG7psHG7N$s9H<kpsrN'7F/@5$#

m: UNIX 79F`G Cisco k<?<QN Risk Manager "@W?<r=.9kKO" Risk

Manager D-9/jWHK!NQ9rXj7F/@5$#


4HQNWiCHU)<`QN Tivoli SNMP "@W?<r$s9H<k9k0K"Cisco k

<?<r$s9H<k7F*+J1lPJj^;s# SNMP "@W?<O"Windows 79F

`^?O UNIX 79F`K$s9H<k9k3H,G-^9#$s9H<k}!KD$F

O"VTivoli Enterprise Console "@W?<&,$IWr2H7F/@5$#

TEC $YsH&5<P<KO"@W?<r$s9H<k7J$G/@5$#=NeojK"

=liN"@W?<r$YsH&5<P<+i[[7F/@5$#

Risk Manager U0NWmU!$krHCF"@W?<r[[9klg" ACF r$s9H<

k7J1lPJj^;s#ACF N\YKD$FO"49Z<8NXACF rHQ7? Risk

Manager "@W?<N=.*hS[[Yr2H7F/@5$#

Risk Manager H&Ks!5lF$k Cisco k<?<Q"@W?<O" tecad_snmp.cds *h

S tecad_snmp.oid U!$kG=.5l^9#3liO"SNMP "@W?<, Cisco k<?

<N SNMP HiCWr TEC $YsHKQ99kh&=.9k?aK,WJU!$kG9#

Tivoli D-G Cisco k<?<Q"@W?<r$s9H<k7"=.9kKO"J<N?9/

rBT7^9#

��+�79F`NG-J$s9H<k&Wm0i`rHQ7F" Cisco k<?<Q"@W?<r$

s9H<k9k3H,G-^9#\7/O"33Z<8NXRisk Manager N$s9H<kYr

2H7F/@5$#

!N$:l+rT$^9#


11.C

isco�

��

��

�

1. ,WK~8F"Cisco k<?<Q"@W?<N/i9jA9F<HasH (.cds) U!$k

tecad_snmp.cds rT87^9#Cisco k<?<Q"@W?<O"3NU!$kbN(sH

j<r*r7F3asH=9k3HKhCF409k3H,G-^9#

2. tecad_snmp.cds *hS tecad_snmp.oid U!$kr,Q7F"TME "@W?<r=.7

^9#

Cisco ��i|$s9H<k=.,*oC?i"Cisco k<?<Q"@W?<r=.7^9#

1. ,WK~8F"Cisco k<?<&HiCWr SNMP $YsHH7F UNIX Kw.9kh

&K=.7^9# 159Z<8NXCisco k<?<N;CH"CWYr2H7F/@5$#

2. ,WK~8F"TEC SNMP "@W?<, Cisco k<?<&"i<`r Risk Manager K

>w9kh&K=.7^9#159Z<8NXUNIX QN Tivoli J0N SNMP "@W?<N

;CH"CWYr2H7F/@5$#

TEC SNMP ��Risk Manager KO"TEC SNMP "@W?<&U!$k (tecad_snmp.cds *hS

tecad_snmp.oid) r979k?aNWmU!$k,s!5lF$^9#

Cisco k<?<Q SNMP "@W?<NWmU!$krBT9k0K"TEC SNMP "@W?

<&U!$kNPC/"CW&3T<rn.7F/@5$#3NWmU!$kO SNMP "@

W?<rd_7"(sI]$sHeN TEC U!$kr Risk Manager ,s!9kU!$kK

V-9(F" SNMP "@W?<rFO07^9#

J<N9FCWK>CF"TEC SNMP "@W?<, Cisco k<?<&"i<`r Risk

Manager K>w9kh&K=.7^9#

1. "I_K9Hl<?<N TME G9/HCWG"GU)kHN TEC Nhr(9

VTEC-Region (TEC Nh)W"$3sr@Vk/jC/7^9#


k&^M<8c<)W&#sI&r=(7^9#

3. VSNMP Adapter for Cisco Router (Cisco k<?<Q SNMP "@W?<)WWmU!$k&"$3sr@Vk/jC/7F"VAdapter Configuration Profile ("@W?<=.W

mU!$k)W&#sI&r*<Ws7^9#

4. VAdd Entry ((sHj<NIC)Wr/jC/7^9#

5. "@W?<&?$WK:v9k tecad_snmp r*r7"VSelect & Close (*r & /m<:)Wr/jC/7^9#

6. VEdit Adapter Configuration ("@W?<=.NT8)W&#sI&G"VDistribution ([[)Wr/jC/7F"U!$kN[[j9Hr=(7^9#

GU)kHN[[Q9O"Risk Manager ,s!9k SNMP U!$kGOJ/"TEC

SNMP U!$krX7F$^9#[[=<9r Risk Manager P<8gsrX9h&KQ

99k}!"^? TEC P<8gsH Risk Manager P<8gsr^<89k}!KD$

FO" Tivoli qAr2H7F/@5$#

,:"[[j9HK"Risk Manager ,s!9k tecad_snmp.cds *hS tecad_snmp.oid

U!$k"^?O Risk Manager U!$kH^<85l?U!$kr~lF/@5$#

158 P<8gs 3 jj<9 8

7. B]NU!$k*hSQ9rT89kKO"!Nh&K7^9#

¶ WmU!$krHQ7F[[9kj9HbNU!$kr@Vk/jC/7^9#

¶ yf (=) N#K"kU)k@<&\?sr/jC/7FQ9r_j7^9#Q9O!

Nh&KJj^9#

hostname/usr/local/Tivoli/bin/generic_unix/RISKMGR/ACF_REP/

¶ Q9N_jr]I9klgO"A'C/^</r*r7^9#

8. VSave & Close (]8 & /m<:)W\?sr/jC/7^9#

Cisco ��&+�+�;CH"CWrOak0K"Cisco k<?<K SNMP "@W?<,$s9H<k5lF$k

^7sXNP),"k+I&+rN'7F/@5$#

Cisco k<?<QK Risk Manager "@W?<rHQ9kh& Cisco k<?<r;CH"CW

9kKO"!Nh&K7^9#

1. Cisco k<?<r$s9H<k7?^7sK Telnet Gm0$s7F"secret 3^sIr/T7^9#

2. config 3^sIr/T7^9#

3. !Nh&K~O7^9#

snmp-server host 5.6.7.8

5.6.7.8 O"SNMP "@W?<r$s9H<k7?^7sN IP "Il9G9#

4. !Nh&K~O7^9#

snmp-server enable traps

5. SNMP "@W?<,$s9H<k5lF$k^7sKX"7? SNMP 3_eKF#<>

r MyCommun K_j9kKO"!Nh&K~O7^9#

snmp-server community MyCommun

6. exit 3^sIr 2 Y/T7F";C7gsrD8^9#

UNIX �� Tivoli �� SNMP ��&+�+�Internet Security Systems RealSecure (ISS RealSecure) Q"@W?<H Cisco k<?<Q"@

W?<OIAib Tivoli SNMP "@W?<rHQ7^9#?H(P"ISS RealSecure Q"@

W?<r{K;CH"CW7F"klgO" Cisco k<?<Q"@W?<KD$F3Njg

r+jV9,WO"j^;s#

Tivoli SNMP "@W?<N$s9H<k}!Nb@O"VTivoli Enterprise Console "@W?

<&,$IWr2H7F/@5$#=NeG"4HQN*Zl<F#s0&79F`,Q1C

Hr TEC $YsH&5<P<KP)XjG-k3HrN'7F/@5$#

Tivoli J0ND-G SNMP "@W?<r;CH"CW9kKO"J<Nh&K7^9#

1. SNMP "@W?<r$s9H<k7^9#?H(P"SNMP "@W?<r AIX ^7sN

/test/riskmgr/snmp/ G#l/Hj<K$s9H<k9k3H,G-^9#

2. SNMP "@W?<r$s9H<k7?G#l/Hj<K\07^9#

cd /test/riskmgr/snmp/etc


11.C

isco�

��

��

�

3. tecad_snmp.conf =.U!$krT87" ServerLocation r^`Tr57^9#

4. 3NTr!Nh&KQ97^9#

ServerLocation=1.2.3.4

1.2.3.4 O"TEC $YsH&5<P<N IP "Il9r(7^9#

5. $YsH&5<P<, Windows NT 79F`G"klgd" Tivoli J0N SNMP "@

W?<rHQ7F$klgO"!NTbIC7^9#

ServerPort=5529

6. /etc/services U!$kK!NTrIC7^9#

snmp-trap 162/tcpsnmp-trap 162/udp

7. TEC $YsH&5<P<N tecad_snmp.cds U!$k*hS tecad_snmp.oid U!$k

r"T8*hSF9H,Qs@U!$kHV-9(^9#

Cisco ��3N;/7gsGO"Cisco k<?<Q"@W?<KD$FN?9/rb@7^9#

SNMP ��Internet Security System (ISS) RealSecure Q"@W?<H Cisco k<?<Q"@W?<OIA

ib Tivoli SNMP "@W?<rHQ7^9# ISS RealSecure Q SNMP "@W?<r+O9

klgO" Cisco k<?<QN SNMP "@W?<b+O9k3HKJj^9#

SNMP "@W?<rj0G+O9kKO"Tivoli SNMP "@W?<&=UH&'"r$s9

H<k7?G#l/Hj<K\07^9#WiCHU)<`LNGU)kHNLVO!NH*

jG9#

Windows NT 79F`:

%LCFROOT%¥bin¥w32-ix86¥tme¥tec¥adapters¥bin¥net start tecsnmpadapter

Windows NT NlgO"V3sHm<k QMkWrHQ7F SNMP "@W?<r+O9k

3HbG-^9#

AIX 79F`:

/$LCFROOT/aix4-r1/TME/TEC/adapters/bin/init.tecad_snmp start

Solaris 79F`:

/$LCFROOT/solaris2/TME/TEC/adapters/bin/init.tecad_snmp start


?<rHQ7^9#ISS RealSecure Q SNMP "@W?<rd_9klgO" Cisco k<?<

QN SNMP "@W?<bd_9k3HKJj^9#

SNMP "@W?<r+0*Kd_9kH"Cisco k<?<Q"@W?<bd_7^9#3l

O"2 DN"@W?<,&LNU!$k tecad_snmp.cds H tecad_snmp.oid r&Q7F$k

?aG9#

160 P<8gs 3 jj<9 8

SNMP "@W?<rj0Gd_9kKO"Tivoli SNMP "@W?<&=UH&'"r$s9

H<k7?G#l/Hj<K\07^9#WiCHU)<`LNGU)kHNLVO!NH*

jG9#

Windows NT 79F`:

%LCFROOT%¥bin¥w32-ix86¥tme¥tec¥adapters¥bin¥net stop tecsnmpadapter

Windows NT NlgO"V3sHm<k QMkWrHQ7F SNMP "@W?<rd_9k

3HbG-^9#

AIX 79F`:

/$LCFROOT/aix4-r1/TME/TEC/adapters/bin/init.tecad_snmp stop

Solaris 79F`:

/$LCFROOT/solaris2/TME/TEC/adapters/bin/init.tecad_snmp stop

SNMP ��2��ISS RealSecure Q"@W?<H Cisco k<?<Q"@W?<OIAib Tivoli SNMP "@W

?<rHQ7^9#ISS RealSecure Q SNMP G<bsrd_9klgO" Cisco k<?<

QN SNMP G<bsbd_9k3HKJj^9#

SNMP G<bsrd_9kKO"J<Nh&K7^9#

1. SNMP G<bsN ID r+U1kKO"!Nh&K~O7^9#

ps -ef | grep snmpd

2. 33G"pid , SNMP G<bsN ID NlgO"!Nh&K~O7^9#

kill -9 pid

��Tivoli J0ND-GO"$YsHr$YsH&5<P<K>w9kh&K tecad_snmp.conf

=.U!$krT87^9#

3NU!$krT89kKO"J<Nh&K7^9#

1. TEC SNMP "@W?<r$s9H<k7? /etc G#l/Hj<K\07^9#

2. tecad_snmp.conf U!$krT87F"!N(sHj<rQ97^9#

ServerLocation=ip_address

ip_address O$YsH&5<P<N IP "Il9G9#

UNIX ��-��)��SNMP HiCWru.9kh&K"UNIX /etc/services U!$kbN!N(sHj<rQ

97^9#

snmp-trap 162/tcp # snmp monitor trap portsnmp-trap 162/udp # snmp monitor trap port

Cisco ��*+�SNMP TEC "@W?<O SNMP P<8gs 1 NHiCWrh}7^9#


11.C

isco�

��

��

�

Cisco ��*+�J<Nj9HO"$YsH&5<P<K>w5lk Risk Manager $YsHr8.9k"Cisco

G-NHiCWr(7?bNG9#

(s?<Wi$: HiCWN?$W

1.3.6.1.4.1.9.2.11.1 logonIntruder

1.3.6.1.4.1.437.1.1.3 logonIntruder

1.3.6.1.4.1.437.1.1.3 broadcastStorm

1.3.6.1.4.1.9 reload

1.3.6.1.4.1.9 tcpConnectionClose

��*+�J<Nj9HO"FoN+F4j< (=."H]m8<"]<H"k<HQ9JI) K09k

HiCWr(7?bNG9#

1.3.6.1.4.1.9.9.43.2 ciscoConfigManEvent

1.3.6.1.4.1.9.5 sysConfigChangeTrap

1.3.6.1.2.1.47.2 entConfigChange

1.3.6.1.2.1.17 newRoot

1.3.6.1.2.1.17 topologyChange

1.3.6.1.4.1.9.1.111.1.2.3 cat2600TsDmnNewRoot

1.3.6.1.4.1.9.1.111.1.2.3 cat2600TsDmnTopologyChange

1.3.6.1.4.1.9.2.11.1 ipAddressChange

1.3.6.1.4.1.437.1.1.3 ipAddressChange

1.3.6.1.4.1.9.5.14.1.1 ciscoEsStackCfgChange

1.3.6.1.4.1.9.5.14.4 ciscoEsPortStrNFwdEntry

1.3.6.1.4.1.9.5.14.8 ciscoEsVLANNewRoot

1.3.6.1.4.1.9.5.14.8 ciscoEsVLANTopologyChange

�� SNMP ��*+�J<Nj9HO"lL*J SNMP 'Zc2HiCWN+F4j<K09kHiCWr(7?

bNG9#

1.3.6.1.2.1.11 authenticationFailure

162 P<8gs 3 jj<9 8

Cisco Secure PIX Firewall ��


¶ XCisco Secure PIX Firewall N5WY

¶ 165Z<8NXU!$"&)<kI}$YsHY

¶ 167Z<8NXCisco Secure PIX Firewall Q"@W?<N$s9H<k*hS=.Y

¶ 169Z<8NXTEC ?9/Y

Cisco Secure PIX Firewall NI-easF<7gsO"!N Web 5$H+i~j9k3H,

G-^9#


Cisco Secure PIX Firewall ��Cisco Private Internet Exchange (PIX) Firewall P<8gs 5.1.2 O";-ejF#<&]j7

<XNQ9*hS;-ejF#<&]j7<KP7Fn_il?6br!P7F-?9k"T

NNU!$"&)<kG9# Risk Manager KO Tivoli Logfile "@W?< (UNIX Q) *h

S Windows Event Log "@W?< (Windows NT Q) N?aNH%!=,"j^9#

\qGO"J<NQlrHQ7F$^9#

¶ Tivoli Logfile "@W?< (UNIX Q) *hS Windows Event Log "@W?< (Windows

NT Q) NH%!=HO" Cisco Secure PIX Firewall QN"@W?<N3Hr$$^9#

¶ Cisco Secure PIX Firewall O"Risk Manager ;s5<N3Hr$$^9#

Cisco Secure PIX Firewall Q"@W?<O" Tivoli Logfile "@W?<&U)<^CH&U!

$k*hS Windows Event Log "@W?<&U)<^CH&U!$k (=l>l"pix.fmt

*hS pix_nt.fmt) G=.5lF$^9# Risk Manager O3liNU)<^CH&U!$

krHQ7F"TME "@W?<r=.7^9#=N TME "@W?<O Cisco Secure PIX

Firewall ;s5<Kw.5l?$YsHrhj~sG"8.5lkm0&aC;<8r TEC

$YsHK^CW7^9#

Cisco Secure PIX Firewall Q"@W?<O" Cisco Secure PIX Firewall ;s5<,m0&a

C;<8rw.9kh&K=.5lF$k[9HKos7^9#3N[9HO"UNIX 79F

`^?O Windows 79F`&[9HN$:l+G9# Windows 79F`&[9HXNm.

s0KO Cisco PIX Firewall Syslog Server (PFSS) ,,WG9#

Risk Manager O";s5<Nm0&aC;<8EgYr TEC $YsHEgYK!Nh&K

^CW7^9#

12


12.C

iscoS

ecure

PIX

Firew

all��

�

Cisco Secure PIX Firewallm0&aC;<8EgY

TEC $YsHEgY

7 GPC0

HARMLESS6 ps

5 LN

4 Yp WARNING

3 (i< MINOR

2 /jF#+kCRITICAL

1 "i<H

0 [^ FATAL

&��Cisco Secure PIX Firewall Model 506 ;s5<O"=Np\=UH&'"H7FNFQ*Zl

<F#s0&79F`r}?J$NG"MCHo</!o H+J93H,G-^9#3N;

s5<O"bK?<*hS"<+$VQKm0&aC;<8rjb<H&[9HKw.9kh

&K=.7J1lPJj^;s# Tivoli Management Enterprise (TME) "@W?<H%!=O

3Njb<H&[9HK$s9H<k7^9# Risk Manager H%!=rHQ9k3HKh

j"TME "@W?<Oe. Cisco Secure PIX Firewall m0&aC;<8rbK?<7^9#

UNIX 79F`GO"m0&aC;<8O Tivoli Logfile "@W?<G"k syslogd K]I5

l^9# Windows 79F`GO"3liNm0&aC;<8O Cisco PIX Firewall Syslog

Server K]I5l^9#

=Nm0&aC;<8, Risk Manager H%U)<^CH&U!$kNU)<^CH&9F<

HasHHlW9kH" TME "@W?<O=Nm0&aC;<8+iEWJpsr}87"

=lr Risk Manager $YsHH7F$YsH&5<P<K>w7^9#

PFSS O Cisco Secure PIX Firewall Model 506 KO07F$^;s#3lO Cisco Web 5$

H+i@&sm<I9k,W,"j^9# PFSS N@&sm<I"$s9H<k"*hS=

.N}!KD$FO"VInstallation Guide for the Cisco Secure PIX Firewall Version 5.1Wr

2H7F/@5$#

m: Cisco PIX Firewall Syslog Server (PFSS) rHQ9klgO"Windows NT Service Pack 6

r$s9H<k9k3Hr*+a7^9#

TEC CorrelationCisco Secure PIX Firewall O"Tivoli Logfile "@W?< (*hS syslogd) (UNIX Q)"

Windows Event Log "@W?< (*hS PFSS) (Windows NT) rHQ7F$YsHr8.7

^9# TME "@W?<O"Windows NT"AIX"^?O Solaris eN Cisco Secure PIX

Firewall KhCFw.5lkU!$"&)<kX"N$YsHr'17^9# Cisco Secure

PIX Firewall Q"@W?<O"3liN$YsHr TEC $YsHX^CW7^9# Risk

Manager U)<^CH&U!$kOU!$"&)<k&$YsHr Risk Manager $YsHK

^CW7"$YsH&5<P<O3N Risk Manager $YsHHNX"U1rT$^9#

Risk Manager O"pix.baroc U!$kr$YsH&5<P<eK$s9H<k7^9#3N

BAROC U!$kKhCF"$YsH&5<P<O"u.9k Cisco Secure PIX Firewall $

YsHr'17Fh}9k3H,G-^9#Cisco Secure PIX Firewall $YsHO!N 2 D

N+F4j<K,1il^9#

¶ /~X"

164 P<8gs 3 jj<9 8

¶ s/~X"

Risk Manager O/~X"$YsHr RM_IDSEvent /i9KjA7"s/~X"$YsHr

RM_MiscEvent /i9KjA7^9#

�)��6 ��U!$"&)<kKhj"btMCHo</r]n7"/~KP7F"i<Hr/9k3H,

G-^9#U!$"&)<kO"U!$"&)<kX"N$YsHr"$/D+N[Jk+F

4j<K,1Fl]<H7^9#U!$"&)<kX"N$YsHKO"!NbN,"j^

9#

¶ 'ZN:T

¶ vDN:T

¶ \3Nq]

¶ MCHo</&"Il9Q9 (NAT) *hS]<H&"Il9Q9 (PAT) Nc2

TEC ��9�0��TEC k<k&(s8sO"!N 3 DN0-Km\7F=Gr<7^9#

¶ =<9 IP "Il9

¶ 8h IP "Il9

¶ 6bN70KAc<

U!$"&)<kOlLKm0&aC;<8KOU!$"&)<k&;s5<N[9H IP "

Il9rq-~_^;s,"~^"m0&aC;<8KU!$"&)<kN$s?<U'<9

>,=lk3H,"j^9# UNIX GO"Tivoli Logfile "@W?< (syslogd) ,"aC;<

8Nh,K=Nm0&aC;<8w.&N IP "Il9r+0*KUC7^9# Windows G

O"3lrT&h&K PFSS r=.9k3HOG-^;s#

Windows NT QN Cisco Secure PIX Firewall Q"@W?<Nlg"rm_SensorHostname 0

-*hS rm_SensorIPAddr 0-O" Cisco Secure PIX Firewall ;s5<N[9H>H IP

"Il9GOJ/"Risk Manager "@W?<H PFSS ,BT7F$k[9HN[9H>H IP

"Il9K_j5lF$^9# Windows NT QN Cisco Secure PIX Firewall Q"@W?<

O";s5<+iN3li 2 DNEgJpsK"/;9G-J$?a"!K,ZJpsG"

k Risk Manager "@W?<H PFSS ,BT7F$k[9HN[9H>rHQ7F3liN0

-r_j7^9#D^j"$YsH&5<P<K;s5<psH7F>w5lkpsO"B]

KO Risk Manager "@W?<N[9HpsH$&3HKJj^9#

Gg 10 N Cisco Secure PIX Firewall ;s5<+im0&aC;<8ru.9kh&K PFSS

r=.9k3H,G-^9#3N=.GO"3N 10 DN Cisco Secure PIX Firewall ;s5

<+i/.5lk$YsHO9YF"1 DN;s5<+iN$YsHH7F=(5l^9#

UNIX 79F`Nlg"rm_SensorIPAddr 0-O"syslogd 9Hjs0N 2 V\NMG"k

Cisco Secure PIX Firewall ;s5<N IP "Il9K_j5l^9#^?"Cisco Secure PIX

Firewall ;s5<N[9H>bHQG-J$?a" rm_SensorHostname 0-OM N/A K_j5l"3liN 2 DNX"MO UNIX QN Cisco Secure PIX Firewall Q"@W?<G

lS-,]?lk3HKJj^9#


12.C

iscoS

ecure

PIX

Firew

all��

�

UNIX H Windows NT 79F`NIAiNlgKb"Cisco Secure PIX Firewall ,""?C

+<N[9H>d6bN?<2CHKX9kpsru.9k3HO"j^;s#U!$"&)

<kO IP X (Q1CH) U#k?<G"k?a"IP "Il9@1,HQG-k#lNG<?

G9#U#k?<O"6bKX87F$k[9H IP "Il9eN>0kC/"CWKD$F

N[jrT$^;s (^?"BTN?aN?$`"&Hbhj^;s)#3N?aK"Cisco

Secure PIX Firewall QN"@W?<O rm_SourceHostname H rm_DestinationHostnameNIAib_j7^;s#3liN$YsH0-O"GU)kHM N/A N^^G9#

PIX Firewall "@W?<O"rm_SourceIPAddr H rm_DestinationIPAddr (?/NlgIA

i+ 1 D) NG<?,9Hjs0bG-zJlg"3N_jrT$^9#

[HsIN Cisco Secure PIX Firewall m0&aC;<8KO IP "Il9,^^lF$^9

,"8`6b70KAc<O^^lF$^;s#3lO"U!$"&)<k,3N70KAc

<NP=r,:7b6bH7F=G9ko1GOJ$?aG9#

�� Cisco Secure PIX Firewall ��3<:�

[HsIN Cisco Secure PIX Firewall m0&l3<IKO IP "Il9,"j^9,"8`

*J6b70KAc<O"j^;s#/~X"N Cisco Secure PIX Firewall m0&aC;<

8KX7F" Risk Manager GO"70KAc<H7F!N9Hjs0,s!5l^9#

fw_conn_deny \3,]'5l?#

fw_pkt_modified Cisco Secure PIX Firewall O]4N?aKQ1CHrQ97?#

fw_xlate_deny MCHo</&"Il9Q9 (NAT) ^?O]<H&"Il9Q9

(PAT) N:TKhj"Q1CH,|n5l?#

fw_tunn_deny HsMkNEf=^?OEf=r|,]'5l?#

fw_acl_deny "/;9&0k<WvDN:TKhj"Q1CH,|n5l?#

fw_auth_deny 'ZN:TKhj"Q1CH,|n5l?#

fw_ipsec HsMkbN IPSEC VPN $YsHN'Z,:T7?D=-,"k#

�� Cisco Secure PIX Firewall ��3<:�

/~r1L7J$ Cisco Secure PIX Firewall $YsHKD$FO" Cisco Secure PIX

Firewall Q"@W?<, RM_MiscEvent +iI87?/i9K$YsHrw.7^9#Cisco

Secure PIX Firewall Q"@W?<O"s/~X" Nm0&aC;<8r!Nh&K3<I=

7^9#

fw_pixfw_signature Cisco Secure PIX Firewall catchall 70KAc<#

fw_snmp 7sWk&MCHo</I}WmH3k (SNMP) $YsH#

fw_conn_permit \3,vD5l^7?#

fw_xlate_permit MCHo</&"Il9Q9 (NAT) ^?O]<H&"Il9Q9

(PAT) ,5oG"k#

fw_failover "kU!$"&)<k+i=NPC/"CWXNU'$k*<P< (b

DQ-!=) ,/87?#

fw_authentication 'Z$YsH#

fw_routing U!$"&)<kK*1kk<F#s0dj#

fw_configuration U!$"&)<kN=.NQ9^?O=lKX9kdj#

fw_internal U!$"&)<kK*1kbt(i<#

166 P<8gs 3 jj<9 8

Cisco Secure PIX Firewall ��3N;/7gsGO"$s9H<k*hS=.KX9kM8v`KD$Fb@7^9#

Cisco Secure PIX Firewall��$s9H<kN0K"VTivoli Risk Manager jj<9&N<HWr2H7F"=UH&'"


Cisco Secure PIX Firewall ;s5<O"Cisco Secure PIX Firewall QN"@W?<r$s9H

<k9k0K$s9H<k7F*+J1lPJj^;s#

^?"4HQNWiCHU)<`QN TME "@W?<b$s9H<k7J1lPJj^;

s#$s9H<k}!KD$FO"VTivoli Enterprise Console "@W?<&,$IWr2H

7F/@5$#

TEC $YsH&5<P<eKO"@W?<r$s9H<k7J$G/@5$#=Neoj

K""@W?<r TEC $YsH&5<P<+i[[7F/@5$#

Risk Manager ,s!9kWmU!$krHQ7F"@W?<r[[9klg""@W?<=

.!= (ACF) r$s9H<k9k,W,"j^9#ACF N\YKD$FO"49Z<8N

XACF rHQ7? Risk Manager "@W?<N=.*hS[[Yr2H7F/@5$#

Cisco Secure PIX Firewall N TEC ?9/,BT7F$k79F`H1879F`K" Risk

Manager Perl Support r$s9H<k7F*+J1lPJj^;s#

"@W?<O"Tivoli D-N Tivoli (sI]$sH+"Tivoli J0NN<IK$s9H<k

G-^9#

m: UNIX 79F`G Cisco Secure IDS QN Risk Manager "@W?<r=.9kKO"

Risk Manager D-9/jWHK!NQ9rXj7F/@5$#


Cisco Secure PIX Firewall ��Tivoli D-G Cisco Secure PIX Firewall Q"@W?<r=.9kKO"!N?9/rBT7

^9#

1. ,WK~8F"Cisco Secure PIX Firewall Q"@W?<NU)<^CH&U!$krT8

7^9#Cisco Secure PIX Firewall Q"@W?<O"3NU)<^CH&U!$kbN(

sHj<r*r7F3asH=9k3HKhCF40G-^9#

UNIX 79F`pix.fmt

Windows 79F`pix_nt.fmt

2. Risk Manager "@W?<NU)<^CH&U!$kr Tivoli U)<^CH&U!$kH

^<87" 47Z<8NXRisk Manager H TME "@W?<NU)<^CH&U!$kN

kgYNX(K>CF"/i9jA9F<HasH (.cds) U!$kr8.7^9#

UNIX 79F`pix.fmt U!$kr{8N tecad_logfile.fmt U!$kN<KIC7F/@5

$#


12.C

iscoS

ecure

PIX

Firew

all��

�

Windows 79F`pix_nt.fmt U!$kr{8N tecad_nt.fmt U!$kN<KIC7F/@5$#

3. :vNU!$kr,Q7^9#

UNIX 79F`:pix.fmt

Windows 79F`:pix_nt.fmt

ACF rHQ9klgO"49Z<8NXACF rHQ7? Risk Manager "@W?<N=.*h

S[[Yr2H7F/@5$#

Cisco Secure PIX Firewall ��!� ��Cisco Secure PIX Firewall QN"@W?<rHQ9klgO" PIX $YsHr Risk Manager

Event Integration Facility s!Nm<+k TCP/IP ]<HKk<F#s09kh&" TEC

Logfile "@W?< (^?O Windows Event Log "@W?<) r=.9k3Hr*+a7^

9#3lKhj"PIX $YsH, Risk Manager EIF NWs(s8sKhCFh}5l^9#

!NjgK>$"PIX $YsHrm<+k TCP/IP ]<HKk<F#s07F/@5$#

1. s TME P<8gsN UNIX Logfile "@W?<"^?Os TME P<8gsN Windows

Event Log "@W?<,$s9H<k5lF$k3HrN'7^9#

2. Risk Manager EIF ,$s9H<k5lF$k3HrN'7^9#

3. PIX U)<^CH&U!$k pix.fmt rHQ9kh& UNIX Logfile "@W?<r=.9

k+"pix_nt.fmt U)<^CH&U!$krHQ9kh& Windows Event Log "@W?

<r=.7^9#

4. Risk Manager EIF K"/;97F Logfile "@W?< (^?O Windows Event Log "@

W?<) H1879F`GBT9kh& UNIX Logfile "@W?<r=.7^9#3N=

.KO""@W?<N=.U!$k (tecad_logfile.conf ^?O tecad_win.conf) K!N 2 D

NQia<?<r_j7^9#

ServerLocation=localhostServerPort=5529

5. s TME P<8gsN Risk Manager EIF rHQ9klgO" EIF =.U!$k

(rmad.conf) K!NQia<?<r_j7^9#

ServerLocation=tecserver (where tecserver is the hostname of TEC �� in your environment)ServerPort=5529 (or 0 if the server is a Unix server)

m: TME P<8gsN Risk Manager EIF Nlg"3liNQia<?<r_j9k,WO

"j^;s#

Cisco Secure PIX Firewall ��i|$s9H<kH ACF =.NeO"J<N9FCWrBT7F Cisco Secure PIX Firewall

r=.7^9#

1. Configure_PIX_Firewall_Logging TEC ?9/rHQ7F"Cisco Secure PIX Firewall ;

s5<N$YsHN-?}!r=.7^9#b@KD$FO"172Z<8NX;s5<&m

.s0=.NQ9Yr2H7F/@5$#

168 P<8gs 3 jj<9 8

2. Cisco Secure PIX Firewall Q"@W?<rHQ9k0K";s5<Km0*s7F"/m

C/_jr!Nh&K=.7^9#

clock set hh:mm:ss month day year

3. Windows Event Log "@W?<rHQ9klgO"=.U!$k tecad_nt.conf rT8

7^9#\7/O"174Z<8NX=.U!$kNT8Yr2H7F/@5$#

4. TME "@W?<rd_7FFO07"=.NQ9r-zK7^9#

TEC ��

m: Cisco Secure PIX Firewall N TEC ?9/O"AIX *hS Solaris NWiCHU)<`G

N_HQD=G9#

Risk Manager O"Cisco Secure PIX Firewall KP7FJ<N TEC ?9/rs!7^9#

¶ Configure_PIX_Firewall_Access O";s5<&"/;9=.rQ97^9#

¶ Show_PIX_Firewall_Configuration O";s5<N=.psr=(7^9#

¶ Configure_PIX_Firewall_Logging O";s5<Nm.s0=.rQ97^9#

Cisco Secure PIX Firewall TEC ��Cisco Secure PIX Firewall TEC ?9/rBT9k0K"J<N@rN'7F/@5$#

¶ Cisco Secure PIX Firewall N TEC ?9/,BT7F$k79F`H1879F`K"

Risk Manager Perl Support r$s9H<k7F*+J1lPJj^;s#Risk Manager

N=J CD KO"AIX *hS Solaris eN Cisco Secure PIX Firewall Q"@W?<KP

7F Risk Manager ,s!9k?9/K,WJ Perl 5]<H,^^lF$^9#

¶ TEC N"I_K9Hl<?<O";s5<N IP "Il9";s5<NQ9o<I"*h

S;s5<N enable Q9o<IrNCF*+J1lPJj^;s#3lOC"3^sI

r;s5<eGBT9k"Brh@9k?aK,WG9#^?";-e"&MCHo</

+i;s5<Nbt$s?<U'<9K telnet Gm0$s9kKOvD,,WG9#3l

OU!$"&)<kN"I_K9Hl<?<KhCFj0G?(il^9#

¶ U!$"&)<kN"I_K9Hl<?<O"TEC "I_K9Hl<?<K3N 2 DN

Q9o<IrNi;k3HKhCF" TEC ?9/KP9kG**J)f"r}D3HK

Jj^9#U!$"&)<kN"I_K9Hl<?<O"Q9o<IrQ97F TEC "

I_K9Hl<?<NU!$"&)<k!=r|n9k3H,G-^9#U!$"&)<

kN"I_K9Hl<?<O",WJQ9o<IrO90K" TEC "I_K9Hl<?

<,=N5$HN;-ejF#<&]j7<r=,K}r7F$k+I&+N'7J1l

PJj^;s#G**K"U!$"&)<kN"I_K9Hl<?<OU!$"&)<k

Km0$s9k?aN!=r]}7F*-" TEC "I_K9Hl<?<, TEC ?9/

rp7F/T7?T,WJ3^sIrK~7^9# TEC "I_K9Hl<?<,Q9o

<IrQ97FU!$"&)<k&"I_K9Hl<?<rmC/"&H9k3HOG-

^;s#

��4��Q9o<IrO8a"=.3^sIO?9/rBT9k[9H+i Cisco Secure PIX Firewall

;s5<^G @(*K Aoj^9#Q9o<I,Ef=5l?j]4-,!:5l?j9k

3HOJ$?a" TEC ?9/rBT7F$k[9HH Cisco Secure PIX Firewall ;s5<

NVKO Virtual Private Network (VPN) HsMkrjA7Fh0=5;F/@5$# VPN


12.C

iscoS

ecure

PIX

Firew

all��

�

HsMkNjA*hSh0=N\YKD$FO"VConfiguration Guide for the Cisco Secure

PIX Firewall Version 5.1Wr2H7F/@5$#

&��&��3N TEC ?9/Khj"\3rVmC/^?OsVmC/=9k?aN;s5<N=.rQ

97^9# TEC ?9/rBT9k0K",:""@W?<r(sI]$sHeK$s9H<

k7F/@5$#

;s5<&"/;9=.rQ99kKO"!Nh&K7^9#


2. Configure_PIX_Firewall_Access TEC ?9/r*r7^9#

3. ?9/G-NQia<?<r_j7^9#_jG-kQia<?<O!NH*jG9#

IP address (IP "Il9) "/;9=.rQ97?$ Cisco Secure PIX Firewall ;s5<N IP

"Il9rXj7^9#3NQia<?<O,\G9#

Telnet password

(Telnet Q9o<I)

Cisco Secure PIX Firewall ;s5<XN"/;9r'D9k telnet Q

9o<IrXj7^9#3NQia<?<O,\G9#

Configuration (enable)

password (=.

(enable) Q9o<I)

Cisco Secure PIX Firewall ;s5<N=.rQ99k3Hr'D9k

enable Q9o<IrXj7^9#3NQia<?<O,\G9#

Action ("/7gs) 3NQia<?<O,\G9#J<N;s5<&"/7gsNf+i

"/7gsr 1 DXj7^9#

¶ 7,N]'NIC

¶ {8N]'N|n

DjNQia<?<,"J0KIC7?]'NQia<?<H5N

KlW9kh&K7J1lPJj^;s#

¶ =TN Cisco Secure PIX Firewall "/;9=.N=(

3NQia<?<O" Cisco Secure PIX Firewall N"/;9&j

9H""/;9&0k<W"*hSEf=^CW,=(5l^9#

3liO"eN"/7gsN?aN,ZJ"/;9&j9Hr1L

9k?aKHQG-^9#

3NGU)kHMO7,]'NICG9#3NQia<?<O,\G

9#

Access list ("/;9&j

9H)

]'rIC^?O|n9k Cisco Secure PIX Firewall ;s5<N"/

;9&j9HrXj7^9#

"/;9&j9H,{K8_7F$klgO"Show access ("/;9N=() rXj7F3NQia<?<rHQ9k3HKhCF",Z

J"/;9&j9Hr*r7F/@5$#

"/;9&j9H,8_7F$J$lgO"77$"/;9&j9H

,n.5l^9,"3lO$s?<U'<9^?OEf=^CWKO

P$sI5l^;s# Cisco Secure PIX Firewall ;s5<GP$sI

rj0GBT7J1lPJj^;s#P$sI,0;9k^G"Hi

U#C/O]'5l^;s#

3NQia<?<O,\G9#

170 P<8gs 3 jj<9 8

Protocol (WmH3k) ]'"/7gsN IP WmH3krXj7^9#

Cisco Secure PIX Firewall ;s5<,5]<H9k IP WmH3kVf

(c"6) ^?O IP WmH3k&jFik> (c"tcp) rXjG-^

9#

3NQia<?<rVis/N^^K7F*/H"IP WmH3k

(TCP"UDP"ICMP) O]'5l^9#

3NQia<?<O*W7gsG9#

Source IP address (=<9

IP "Il9)

]'"/7gsN=<9 IP "Il9rXj7^9#

3NQia<?<O"1l[9HH7FXj9k+" source IPaddress mask (=<9 IP "Il9&^9/) Qia<?<rHQ7

F$klgO"5VMCHo</H7FXj9k3H,G-^9#

CjN IP "Il9KP7Fwu.5lkQ1CHr]'9klg

O"3N?9/rFYBT7F"Cisco Secure PIX Firewall ;s5<

N"/;9=.K 2 D\N]'X(rIC7F/@5$#

3NQia<?<rVis/K7F*/H"9YFN=<9 IP "I

l9+i8h IP "Il9XNQ1CH,]'5l^9#

3NQia<?<O*W7gsG9#

Source IP address mask

(=<9 IP "Il9&^

9/)

]'"/7gsN=<9 IP "Il9&^9/rXj7^9#

5VMCHo</4Nr 1 DN=<9H7F]'9kKO"5VMC

Ho</N IP "Il9&^9/ (c"255.255.255.240) rXj7^

9#

3NQia<?<rVis/N^^K7F"source IP address (=<9 IP "Il9) Qia<?<rXj9klg"=<9 IP "Il9

O1l[9Hr(9bNH[j5l^9#

3NQia<?<O*W7gsG9#

Destination IP

address (8h IP "Il

9)

]'"/7gsN8h IP "Il9rXj7^9#

3N8h IP "Il9O"1l[9HH7FXj9k+" destinationIP address mask (8h IP "Il9&^9/) Qia<?<rHQ

7F$klgO"5VMCHo</H7FXj9k3H,G-^9#

CjN IP "Il9KP7Fwu.5lkQ1CHr]'9klg

O"3N?9/rFYBT7F"Cisco Secure PIX Firewall ;s5<

N"/;9=.K 2 D\N]'X(rIC7F/@5$#

3NQia<?<rVis/K7F*/H"=<9 IP "Il9+i

9YFN8h IP "Il9XNQ1CH,]'5l^9#3NQia

<?<O*W7gsG9#

Destination port (8h]<

H)

]'"/7gsN8h]<HrXj7^9#

]'"/7gsN=<9&]<HrXj9k3HOG-^;s#

Cisco Secure PIX Firewall ;s5<,5]<H9k]<HVf (c"

80) ^?O]<H&jFik> (c"www) rXjG-^9#

3NQia<?<O*W7gsG9#


12.C

iscoS

ecure

PIX

Firew

all��

�

&��;s5<N=_N=.r=(9kKO"3N TEC ?9/rHQ7^9#3N?9/rHQ7

F"5$HN;-ejF#<&]j7<,57/$sWjasH5lF$k+I&+r!:9

k3H,G-^9# TEC ?9/rBT9k0K",:""@W?<r(sI]$sHeK$

s9H<k7F/@5$#


2. Show_PIX_Firewall_Configuration r/jC/7^9#

3. ?9/G-NQia<?<r_j7^9#!NQia<?<,9YF,WG9#

IP address (IP "Il9) =.r=(7?$ Cisco Secure PIX Firewall ;s5<N IP "Il9

rXj7^9#

Telnet password

(Telnet Q9o<I)


9o<IG9#


password (=.

(enable) Q9o<I)

Cisco Secure PIX Firewall ;s5<N=.NQ9r'D9k enable Q

9o<IG9#

Show configuration (=.

N=()

Cisco Secure PIX Firewall ;s5<N=TN=.r=(9kKO"

VYes (O$)Wr*r7^9#POKO"P<8gs"=."abj

<&VmC/"$s?<U'<9"Wm;9"U'$k*<P<,^

^l^9#

Show connections (\3N

=()

Cisco Secure PIX Firewall ;s5<GN=TN"/F#V\3r=(

7?$lgO"VYes (O$)Wr/jC/7^9#

Show user

authentications (f<6<

'ZN=()

Cisco Secure PIX Firewall ;s5<GN=Tf<6<N'Z*hSv

Dr=(9kKO"VYes (O$)Wr*r7^9#

Show telnets (Telnet N=

()

Cisco Secure PIX Firewall ;s5<XN=TN telnet ;C7gs (3

N;s5<rP39k;C7gsGOJ$) r=(9kKO"VYes(O$)Wr*r7^9#3Nj9HO"m0$s7F$k Cisco Secure

PIX Firewall "I_K9Hl<?<G=.5l^9#3lKO"3N

TEC ?9/N telnet ;C7gsb^^l^9#

&��1?��3N TEC ?9/rHQ7F"U!$"&)<kr77$ Risk Manager ;s5<H7FH_

~`h&K;s5<Nm.s0=.rQ99k3H,G-^9# TEC ?9/rBT9k0

K",:""@W?<r(sI]$sHeK$s9H<k7F/@5$#

Cisco Secure PIX Firewall m.s0r=.9kKO"!Nh&K7^9#


2. Configure_PIX_Firewall_Logging r*r7^9#

3. ?9/G-NQia<?<r_j7^9#Qia<?<OJ<NH*jG9#

172 P<8gs 3 jj<9 8

IP address (IP "Il9) m.s0=.rQ97?$ Cisco Secure PIX Firewall ;s5<N IP

"Il9rXj7^9#

3NQia<?<O,\G9#

Telnet password

(Telnet Q9o<I)


9o<IrXj7^9#

3NQia<?<O,\G9#


password (=.

(enable) Q9o<I)

Cisco Secure PIX Firewall ;s5<N=.rQ99k3Hr'D9k

enable Q9o<IrXj7^9#

3NQia<?<O,\G9#

Logging host

interface name (m.s

0&[9H&$s?<U

'<9>)

Cisco Secure PIX Firewall ,m0&5<P<QKHQ9k$s?<U

'<9N>0rXj7^9#

Cisco Secure PIX Firewall Q"@W?<O"m0&5<P<NaC;

<8rbK?<7F"=lir$YsH&5<P<K>w7^9#

3NGU)kHMO inside G9#3NQia<?<O*W7gsG

9#

Logging host IP

address (m.s0&[9H

IP "Il9)

Cisco Secure PIX Firewall Q"@W?<,bK?<7F$km0&5

<P<N IP "Il9rXj7^9#

3NQia<?<O*W7gsG9#

Logging trap level (m.s

0&HiCW&lYk)

m0&5<P<Kw.5l"=Ne Cisco Secure PIX Firewall Q"

@W?<+i$YsH&5<P<Kw.5lkm0&aC;<8Nl

YkrXj7^9#

~OG<?O9Hjs0 (c"errors) ^?OtM (c"3) GXj7

^9#

3NGU)kHMO errors G9#3NQia<?<O*W7gsG

9#

Logging facility (m.s0

!=)

m0&aC;<8HloKw.9k syslog !=VfrXj7^9#

3NGU)kHMO 20 G9#3lO"LOCAL4 !=Km0&aC

;<8rw.9k?aNlYk, 20 G"k3Hr(7^9#

3NQia<?<O*W7gsG9#

Logging enabled (m.s0

HQD=)

VYes (O$)Wr*r9kH"Cisco Secure PIX Firewall ;s5<K

*1km.s0rHQD=K7^9#

VNo ($$()Wr*r9kH"m.s0rHQTDK7^9#m

0&aC;<8,m0&5<P<Kw.5l?j"Cisco Secure PIX

Firewall Q"@W?<KhCF$YsH&5<P<K>w5lk3H

O"j^;s#

3NGU)kHMO VYes (O$)WG9#3NQia<?<O,\

G9#

Cisco Secure PIX Firewall ��Cisco Secure PIX Firewall QN"@W?<GO"!N?9/rT&3H,G-^9#


12.C

iscoS

ecure

PIX

Firew

all��

�

��1�1?��

Risk Manager U0N TEC ?9/rH&3HKC(F"m0&aC;<8r TME "@W?

<Kw.9kh&"j0G Cisco Secure PIX Firewall r=.9k3H,G-^9#TME "@

W?<O" UNIX ^7sGT07F$k Tivoli Logfile "@W?< (syslogd) +" Cisco PIX

Firewall Server (PFSS) rT07F$k Windows NT ^7sN$:l+KJj^9#

Cisco Secure PIX Firewall r=.7F"m.s0rBTG-kh&K9k,W,"j^9#m

0&aC;<8O" Risk Manager G!=/=7? Tivoli Logfile "@W?<rBT7F$k

[9HKw.9kh&K7F/@5$#

Cisco Secure PIX Firewall =.3^sIH=l>lNb@O"!NH*jG9#

logging on m0-?hN[9HK~1Fm0&aC;<8Nw

.r+O7^9#

logging host [if_name] ip_addr m0&aC;<8Nw.hN[9HrXj7^9#

TME "@W?<^?O Cisco Secure PIX Firewall

Q"@W?<,T09k[9HK_j7F/@5

$#

logging trap level Cisco Secure PIX Firewall Q"@W?<,"EgY

3 ((i<) N$YsHrEgY 0 ([^vV) K<

2F>w9kh&K9kKO" level r 3 K_j

7^9#

logging facility facility m0&aC;<8ru1hk syslog 5<P<!=

rXj7^9#m0&aC;<8r LOCAL4 !=

Xw.9kKO"lYkr 20 KXj7^9#

timestamp logging w.5lkFm0&aC;<8K?$`&9?sW

MrU1k3HrXj7^9#3N3^sIr/T

9klgO" clock set 3^sIb/T9k,W

,"j^9#

no logging message log_id Cisco Secure PIX Firewall K*1kD9Nm0&a

C;<8r^)7^9# %PIX-6-302010 r^)9

klg"log_id r 302010 KXj7^9#

3N3^sIO*W7gsG9#

clock set hh:mm:ss month day year Cisco Secure PIX Firewall N/mC/_jGOnH

|rlYK_jG-^9," Cisco Secure PIX

Firewall Q"@W?<GOnr_j7F+i|r_

j7^9#

��)��

Windows Event Log "@W?<rH&lg"tecad_nt.conf U!$krT87"!N`\r

IC7^9#F-9HO9YF"U!$kbN 1 TKIC7F/@5$#33GOZ<8b

K}^kh&"(sHj<r#tTK,1F$^9#

LogSources=pfss_install_dir¥monday.log,pfss_install_dir¥tuesday.log,pfss_install_dir¥wednesday.log,pfss_install_dir¥thursday.log,pfss_install_dir¥friday.log,pfss_install_dir¥saturday.log,pfss_install_dir¥sunday.log

5iK"!N`\rLNTKIC7^9#

PollInterval=1

174 P<8gs 3 jj<9 8

��*�;*��

?9/&i$Vij<O"Cisco Secure PIX Firewall Q"@W?<N$s9H<k~K+0*

Kn.5lP?5l^9#7+7"Tivoli wtll 3^sIrH&H" Tivoli ]j7<&j<8

gsbK?9/&i$Vij<rP?9k3H,G-^9#

?9/&i$Vij<rj0Gn.9kKO"wtll 3^sIrH$"?9/rn.9k]j7

<&j<8gsrXj7^9#

Windows 79F`:

wtll -r -p TEC-Region -P $CPP_LOCATION%BINDIR$¥RISKMGR¥corr¥tasks¥rmt_tasks.tll -P

UNIX 79F`:

wtll -r -p TEC-Region -P $CPP_LOCATION$BINDIR/RISKMGR/corr/tasks/rmt_tasks.tll -P

33G"CPP_LOCATION H BINDIR O" cpp WjWm;C5<HG#l/Hj<XNB]

NQ9NLVG9#3NLVK"=l>lN$YsH&5<P<&P$Jj<,~lil^

9#5iK".dsl U!$kb .tll U!$kH18G#l/Hj<KJ1lPJj^;s#

!NLVK cpp Wm0i`r$s9H<k9kh&K7F/@5$ (^?O=UH&js/

rs!)#

/usr/ccs/lib/cpp

^?O"cpp 3^sI,8_9kG#l/Hj<r"79F` PATH D-QtXIC7^

9#


12.C

iscoS

ecure

PIX

Firew

all��

�

176 P<8gs 3 jj<9 8

Check Point FireWall-1 ��


¶ XCheck Point FireWall-1 Q"@W?<N5WY

¶ 179Z<8NXCheck Point FireWall-1 Q"@W?<N$s9H<k*hS=.Y

¶ 185Z<8NXCheck Point FireWall-1 "@W?<NI}Y

Check Point FireWall-1 aC;<8KD$FO"254Z<8NXCheck Point FireWall-1 NaC

;<8Yr2H7F/@5$#

Check Point FireWall-1 Q"@W?<Nb@GHQ9kQlO"Check Point FireWall-1 =JK

*1kQlG9#

Check Point Software Technologies OPSEC SDK N\YKD$FO"!N Web 5$Hr2H

7F/@5$#

http://www.checkpoint.com/opsec/cp_products/opsec_sdk.html ^?O

http://www.checkpoint.com/opsecsdk

Check Point FireWall-1 ��Risk Manager KO"Check Point FireWall-1 Q"@W?<,U07F$^9#3N"@W?<

O"TNN Check Point FireWall-1 =J,8.9kU!$"&)<k/~!N"i<`r"$

YsH&5<P<X>w5lk$YsHK^CW7^9#

U!$"&)<kO"/~KP9k"i<Hr/9k?a@1GJ/"btMCHo</N]

nKr)Dh&K_W5lF$^9#U!$"&)<kO"U!$"&)<kX"N$YsH

r"$/D+N[Jk+F4j<K,1Fl]<H7^9#U!$"&)<kX"N$YsH

KO"!NbN,"j^9#

¶ 'ZN:T

¶ vDN:T

¶ \3Nq]

¶ MCHo</&"Il9Q9 (NAT)/ ]<H&"Il9Q9 (PAT) NQ9c2

Check Point FireWall-1 Q"@W?<O" Check Point Open Platform for Secure Enterprise

Connectivity (OPSEC) 5<P<H Event Logging API (LEA) rH$"U!$"&)<kN"

i<Hr8.7^9#

Check Point FireWall-1 Q"@W?<O Risk Manager Event Integration Facility (EIF) rHQ

7F"$YsHr$YsH&5<P<K>w7FjXrT&+" Tivoli Enterprise Console

13


13.C

heck

Po

int

FireW

all-1��

�

(TEC) 79F`&m0&"@W?<K>w9k3H,G-^9# Check Point FireWall-1 Q"

@W?<O";s5<,hj~`U!$"&)<k&$YsHr$YsH&3s=<kKw.

7" Risk Manager "I_K9Hl<?<,2HG-kh&K7^9#

&��Check Point FireWall-1 Nu7&-!=N*+2G" Check Point FireWall-1 rHC?"/F

#V\3O"MCHo</^?O2<H&'$c2N/8~Gbh7F:olk3H,"j^

;s#

Check Point FireWall-1 =JO"J<rT$^9#

¶ VPN-1/FireWall-1 +i"j"k?$`&m0psHR9Hj<&m0psrB4J}!G

hjP7^9#

¶ ;-ejF#<&$YsHN,OHl]<HrT$^9#

¶ Risk Manager JIN(s?<Wi$:&$YsHI}79F`H}gG-^9#

�)��6 �� LEA ��

U!$"&)<kN;-ejF#<&]j7<KO" FW1_lea \3ru1~lk?aNk<

k,,WG9#!N$:l+N\3?$WG VPN-1/FireWall-1 H\39k3H,G-^9#

¶ /j"\3

¶ 'Z\3

¶ Secure Sockets Layer (SSL) rHCFEf=5l?\3

�)��6 ��

Risk Manager KO"l"NU!$"&)<k&$YsHjA,"j" Risk Manager O3l

ir+0*K$YsH&5<P<Xm<I7^9#3N$YsHjA2KO"U!$"&)<

k/~NB]N!P@1GJ/"U!$"&)<k&=UH&'"N?QNl]<Hb^^l

^9#

Risk Manager GO"FQNU!$"&)<k&$YsH&/i9r cpfw.baroc U!$kG

s!7^9#3lO"Tivoli Risk Manager Server QC1<8H&K$s9H<k5l^

9#

IN"Wj1<7gs^?OU!$"&)<k=Jb"3liN Risk Manager U!$"&)

<k&$YsH&/i9rHCF""i<Hr Risk Manager Xw.9k3H,G-^9#

�)��6 ��

/~!N$YsHO"U!$"&)<kKBu5lF$k;-ejF#<&]j7<HX"7

F$^9#U!$"&)<k&;-ejF#<&]j7<KO"U!$"&)<kGvD^?

Oq]9kh&=.7?P],^^lF$^9#U!$"&)<kN"I_K9Hl<?<O

3lrQ9G-^9# Check Point FireWall-1 QN Risk Manager "@W?<O"!N?$W

NU!$"&)<k&$YsHr8.7^9#

)f$YsH:CPFW_Control

178 P<8gs 3 jj<9 8

f<6<'Z$YsH:CPFW_Auth_Deny

CPFW_Auth_Permit

Internet Control Message Protocol (ICMP) $YsH:CPFW_ICMP_Deny

CPFW_ICMP_Permit

5<S9&$YsH:CPFW_Service_Deny

CPFW_Service_Permit

CPFW_FTP_Deny

CPFW_FTP_Permit

CPFW_HTTP_Deny

CPFW_HTTP_Permit

CPFW_Telnet_Deny

CPFW_Telnet_Permit

CPFW_Login_Deny

CPFW_Login_Permit

Risk Manager �� Check Point FireWall-1 �*��

GU)kHGO"Risk Manager O"EgY0-, WARNING N Risk Manager $YsHK

Check Point FireWall-1 "i<`r^CW7"EgY0-, HARMLESS N Risk Manager $

YsHK)fpsr^CW7^9#3N_jO" cpfw.baroc U!$kGQ99k3H,G-

^9#

Check Point FireWall-1 ��3N;/7gsGO"Check Point FireWall-1 Q"@W?<N$s9H<k*hS=.}!K

D$Fb@7^9#

Check Point FireWall-1 Q"@W?<r$s9H<k9k0K" Check Point FireWall-1 =J

r$s9H<k7^9#Check Point FireWall-1 Q"@W?<N$s9H<k}!KD$F

O"33Z<8NXRisk Manager N$s9H<kYr2H7F/@5$#

Check Point FireWall-1 ��3N;/7gsGO"=.fKT89kU!$kKD$Fb@7^9#

m: UNIX 79F`G Check Point FireWall-1 QN Risk Manager "@W?<r=.9kK

O" Risk Manager D-9/jWHK!NQ9rXj7F/@5$#


Risk Manager EIF �� Check Point FireWall-1 ��

Check Point FireWall-1 Q"@W?<NGU)kH=.GO"$YsHr Risk Manager EIF

Kw.7^9# Risk Manager EIF O"@W?<N$YsHr Risk Manager Server Xw.7


13.C

heck

Po

int

FireW

all-1��

�

^9#"@W?<N$YsHr57/ Risk Manager TEC $YsHK^CW9kKO" Risk

Manager EIF r+9?^$:7F"Check Point FireWall-1 Q"@W?<NU)<^CH&U

!$krHQ9k,W,"j^9#

Risk Manager EIF , Check Point FireWall-1 $YsHK^CW9kh&=.9kKO"

cpfw.fmt U!$kr Risk Manager EIF rmad.fmt U)<^CH&U!$kNGeKIC7^

9#ICeN rmad.fmt U!$krHQ7F"/i9jA9F<HasH (.cds) U!$kr

=.7^9# rmad.cds U!$kr=.9kKO"!Nh&K7^9#

1. csids.fmt r rmad.fmt U!$kNGeKIC7^9#

Windows 79F`:

cat cpfw.fmt >> rmad.fmt

UNIX 79F`:

cp cpfw.fmt >> rmad.fmt

Risk Manager EIF O"Windows 79F`H Unix 79F`$:lNlgb cpfw.fmt r

HQ7^9#

2. riskmgr_gencds 3^sIrBT7F".cds U!$krFn.7^9#


3. 977? rmad.cds U!$kr"Check Point FireWall-1 Q"@W?<,$s9H<k5l

F$k79F`KF[V7^9#

"@W?<=.!=Khj Check Point FireWall-1 GHQ9kh& rmad.cds U!$kr=.

9k}!KD$FO"49Z<8NXACF rHQ7? Risk Manager "@W?<N=.*hS

[[Yr2H7F/@5$#

��)��Check Point FireWall-1 Q"@W?<KX"7?=.U!$kKO"!NbN,"j^9#

¶ Check Point FireWall-1 5<P<=.U!$k

¶ Check Point FireWall-1 QN Risk Manager "@W?<=.U!$k

Check Point FireWall-1 ��)��

Check Point fwopsec.conf =.U!$kO" Check Point VPN-1/FireWall-1 ,>N OPSEC

"Wj1<7gsHL.9k}!r_j9kU!$"&)<k&5<P<=.U!$krjA

7^9#

fwopsec.conf U!$kO"U!$"&)<k&=UH&'"rBT7F$k^7sN

$FWDIR/conf/ G#l/Hj<K"j^9#FWDIR OU!$"&)<k&=UH&'",$s

9H<k5lF$kG#l/Hj<G9#

Check Point FireWall-1 ��)��

Check Point FireWall-1 Q"@W?<N rma_cpfw.conf =.U!$kGO"GU)kHG!N

bF,Xj5lF$^9#

lea_server ip 127.0.0.1lea_server auth_port 18184lea_server auth_type ssl_opseclea_server auth_type auth_opsec

180 P<8gs 3 jj<9 8

3N=.U!$kOQ97J1lPJj^;s#3NU!$kNQ9}!O" fwopsec.conf

U!$"&)<k&5<P<=.U!$kNQ9}!K~8FQoj^9#\YJ=.Nb@

O"179Z<8NXCheck Point FireWall-1 N=.Yr2H7F/@5$#

Check Point FireWall-1 *hS Check Point FireWall-1 Q"@W?<r=.9kKO"!Nh

&K7^9#

1. Check Point FireWall-1 r OPSEC 5<P<H7F=.7^9#XOPSEC 5<P<H7F

N Check Point FireWall-1 N=.Yr2H7F/@5$#

2. OPSEC /i$"sHr=.7^9#182Z<8NXOPSEC /i$"sHH7FN Check

Point "@W?<N=.Yr2H7F/@5$#

3. SAM 5<P<r=.7^9#183Z<8NXSAM 5<P<N=.Yr2H7F/@5

$#

4. Check Point FireWall-1 Q"@W?<r OPSEC 5<P<K\37^9#183Z<8N

XOPSEC 5<P<XN Check Point "@W?<N\3Yr2H7F/@5$#

5. Check Point Policy Editor rHQ7F"!N3HrT$^9#

¶ U!$"&)<k&;-ejF#<&]j7<K FW1_lea \3ru1~lkk<kr

^a^9#

¶ MCHo</&"Il9Q9 (NAT) rHQD=K7^9#

X(KD$FO"VCheck Point VPN-1/Firewall-1 Administration GuideWN;-ejF#

<&]j7<&k<k&Y<9*hS NAT N;/7gsr2H7F/@5$#

Tivoli J0ND-Gb"39Z<8NXG-N$s9H<kKhk Risk Manager 3s]<Ms

HN$s9H<kYNX(K>CF/@5$#

OPSEC �� Check Point FireWall-1 ��Oak0K"VCheck Point VPN-1/FireWall-1 Administration GuideWr2H7F/@5$#

FireWall-1 r OPSEC 5<P<H7F=.9kKO" fwopsec.conf =.U!$krQ97^

9#

fwopsec.conf U!$krQ97?e" OPSEC 5<P<rd_7FO07F"Q9r-zK

9k,W,"j^9#

Check Point FireWall-1 Q Risk Manager "@W?<N rma_cpfw U!$kGO"5<P<>

O lea_server KJj^9#

?H(P"]<H 18184 G LEA /i$"sHHL.7"5<P<H/i$"sHHNVN

\3r'Z*hSEf=9klgO"!Nh&K~O7^9#

lea_server auth_port 18184lea_server auth_type ssl_opsec

fwopsec.conf G OPSEC /i$"sHHN\3rjA9kKO"N)9k\3N?$WK~

8F"!N$:l+N=8U)<^CHrH$^9#

/j"\3Nlg"!Nh&K~O7^9#

lea_server port port_number


13.C

heck

Po

int

FireW

all-1��

�

'Z\3Nlg"!Nh&K~O7^9#

lea_server auth_port port_numberlea_server auth_type auth_opsec

'ZHEf=NJ5l?\3Nlg"!Nh&K~O7^9#

lea_server auth_port port_numberlea_server auth_type ssl_opsec

OPSEC �*�� Check Point ��Risk Manager "Wj1<7gsN rma_cpfw.conf =.U!$krHCF"OPSEC r/i$

"sHH7F=.9klg"!Nh&K7^9#

1. !Nh&K~O7"=.U!$kG OPSEC 5<P<HN/i$"sH\3rjA7^

9#

Windows NT 79F`:

%RMADHOME%¥RISKMGR¥adapters¥etc¥rma_cpfw.conf

UNIX 79F`:

$RMADHOME/RISKMGR/adapters/etc/rma_cpfw.conf

2. 5<P<, OPSEC 5<P<H183sTe<?<eK"klg"k<WPC/&$s?

<U'<9r 127.0.0.1 HXj7^9#

3. !N$:l+N3^sIr~O7^9#

/j"\3Nlg"!Nh&K~O7^9#

lea_server ip ip_addresslea_server port port_number

'Z\3Nlg"!Nh&K~O7^9#

lea_server ip ip_addresslea_server auth_port port_numberlea_server auth_type auth_opsec

Ef=5l?\3Nlg"!Nh&K~O7^9#

lea_server ip ip_addresslea_server auth_port port_numberlea_server auth_type ssl_opsec

c:

/j"\3 ('Z5lF*i:Ef=5lF$J$\3) rH$"]<H 18184 G IP "Il

9 143.193.22.5 K"k LEA 5<P<HL.9kKO"!Nh&K~O7^9#

lea_server ip 143.193.22.5lea_server port 18184

'Z5lF$J$\3rH$"]<H 18184 G IP "Il9 143.193.22.5 K"k LEA 5<

P<HL.9kKO"!Nh&K~O7^9#

lea_server ip 143.193.22.5lea_server auth_port 18184lea_server auth_type auth_opsec

182 P<8gs 3 jj<9 8

'ZQ_GEf=5l? SSL Y<9N\3rH$"]<H 18184 G IP "Il9

143.193.22.5 K"k LEA 5<P<HL.9kKO"!Nh&K~O7^9#

lea_server ip 142.193.22.5lea_server auth_port 18184lea_server auth_type ssl_opsec

SAM ��Check Point FireWall-1 ?9/rT&KO"SAM 5<P<N=.rT&,W,"j^9#!

N TEC ?9/O" Check Point FireWall-1 Q"@W?<HX"7F*j" Risk Manager K

U07F$^9#

¶ CheckPoint_FW-1_by_IP_Address

¶ CheckPoint_FW-1_by_Source_and_Destination

3liN?9/GO"/i$"sHWar SAM 5<P<Xw.9k3HKhj" OPSEC

Suspicious Activity Monitoring (SAM) API rH&3H,G-^9#

SAM 5<P<=.N\YKD$FO"OPSEC NqAr2H7F/@5$# SAM 5<P<

r=.7?e"SAM 5<P<=.psr!NU!$kK3T<7^9#

Windows NT 79F`:

%RMADHOME%¥etc¥rma_cpfw.conf

Solaris 79F`:

$RMADHOME/etc/rma_cpfw.conf

?H(P"!NH*jG9#

sam_server ip 127.0.0.1sam_server auth_port 18183sam_server auth_type auth_opsec

OPSEC �� Check Point ��'Z-<rjA9k?aK"OPSEC "Wj1<7gsr"^:5<P<GBT7"!K/i

$"sHGBT7J1lPJj^;s#

Risk Manager KO"Check Point FireWall-1 [[QC1<8QN Risk Manager "@W?<G

HQ9k opsec_putkey Wm0i`,"j^9# Risk Manager GO"3NU!$kO!N

LVK$s9H<k5l^9#

Windows 79F`:

%RMADHOME%¥bin

UNIX 79F`:

$RMADHOME/bin

2 DN^7s (machine1 H machine2) ,"kH7^9#GiN^7s (machine1) ,U!$"

&)<k&G<bsrBT7^9#b& 1 DN^7s (machine2) GO"Risk Manager

CheckPoint FireWall-1 "@W?<rBT7^9#U!$"&)<k&G<bs*hS Risk

Manager CheckPoint FireWall-1 "@W?<r&K18^7seGBT9k3H,G-^9#

1. Check Point FireWall-1 5<P<G"!N$:l+N3^sIr~O7^9#


13.C

heck

Po

int

FireW

all-1��

�

'Z\3Nlg"!Nh&K~O7^9#

fw putkey -opsec machine2

SSL \3Nlg"!Nh&K~O7^9#

fw putkey -opsec -ssl machine2

2. 'Z-<psN~O,aail?i"=Npsr~O7^9#3N-<O"Gc 6 8zG

9#

3. !N$:l+N3^sIr~O7F"2 V\N5<P<^?O/i$"sH (machine2) r

=.7^9#

'Z\3Nlg"!Nh&K~O7^9#

opsec_putkey machine1

Ef=5l?\3Nlg"!Nh&K~O7^9#

opsec_putkey -ssl machine1

4. 'Z-<psN~O,aail?i"2 N9FCWG~O7?NH18psr~O7^

9#-<O"5<P<^?O/i$"sH machine1 GHC?NH18-<r"5<P<

^?O/i$"sH machine2 GbH&,W,"j^9#

Check Point ;s5<O"-<psr authkeys.C U!$kK]I7^9#3NU!$k

O"$OPSECDIR G#l/Hj<K"j^9#

Windows 79F`:

%RMADHOME%¥etc

UNIX 79F`:

$RMADHOME/etc

5. 3 DJeN5<P<^?O/i$"sHr=.9klg (machine3...machineN)" machine2

GHC?jgr+jV7^9,"\3NH4HKLDN'Z-<rH$^9#

?H(P" machine1 , machine2 H machine3 N>}HL.9klg" machine1 H

machine2 HN\3G 1 DN-<rH$" machine1 H machine3 HN\3GLN-<rH

$^9#

=.r0;7?i"Risk Manager TEC ?9/rHCF"@W?<r+O7^9#\YO"

186Z<8NXWindows NT GN+OY^?O186Z<8NXSolaris GN+OYr2H7F/

@5$#

�� Check Point FireWall-1 �*��

jA5l? Check Point FireWall-1 ]j7<KO"]j7<,/05l?lgKTolkh}

rXj7?_j,^^l^9#3N_jO"HiC/ HFPl^9#

5]<H5lkHiC/H"3l,"i<`H+J5lk+I&+KD$FO"!NH*jG

9#

184 P<8gs 3 jj<9 8

= 18. Check Point FireWall-1 Khj5]<H5lkHiC/

HiC/ $s?<;WH*hSh}

Long J7

Short J7

Account J7

Alert "j

Mail "j

SNMP "j

User "j

Alert"Mail"SNMP"^?O User K]j7<r_j9kH"3l, Risk Manager 5<P<

Khj$s?<;WH5lh}5l^9# Long"Short"*hS Account HiC/O"$s?

<;WH5l:h}OTol^;s#

?@7 Alert"Mail"SNMP"*hS User HiC/Om0Kq-~^l" Check Point m

0&Se<"<Khj=(9k3H,G-^9#

GU)kHrQ99kKO"!Nh&K7^9#

1. Check Point FireWall-1 Policy Editor rHQ7F"U!$"&)<k&k<k&Y<9NH

iC-s0psr Alert"Mail"SNMP Trap"^?O UserDefined KQ97^9#

Short"Long"^?O Account K_j9kH"5k5lh}5l^;s#

2. U!$"&)<k&^7sKk<k&Y<9rFBTMj7^9#

Check Point FireWall-1 ��3N;/7gsGO"TEC N?9/*hSBT,D=Jj03^sIKD$Fb@7^9#

TEC ��TEC ?9/rH&H"Xj5l?j9/KP~9k3H,G-^9#6bKPh9k]"N

'5l?j9/KP7FacK?~7J$h&K7F/@5$#?H(P"6bK?~9k?

aK"a^CFQ1CH&U#k?<&k<krajKh0=5;F7^&3H,"k+b7

l^;s#=Nl}G"=N?~O/~T,;-ejF#<&]j7<rsrG-J$[I=

,JbNK7F/@5$# Risk Manager NU!$"&)<k&$YsHrbK?<9k3H

Khj";-ejF#<&]j7<r409k3H,G-^9#

Risk Manager N?9/&i$Vij<N?9/rH&3HKhj"U!$"&)<k&$Y

sHrhVG-^9#

Risk Manager KO"Tasks for Enterprise Risk Management H$&H+N?9/&i$Vij


HN TEC ]j7<&j<8gsK$s9H<k7^9#

Risk Manager O"Check Point FireWall-1 Q"@W?<KP7FJ<N TEC ?9/rs!7

^9#

¶ Start_CheckPoint_FW-1_Adapter_on_Windows_NT

¶ Start_CheckPoint_FW-1_Adapter_on_Solaris


13.C

heck

Po

int

FireW

all-1��

�

¶ Start_CheckPoint_FW-1_Adapter_on_Solaris

¶ CheckPoint_FW-1_by_IP_Address

¶ CheckPoint_FW-1_by_Source_and_Destination

¶ Stop_CheckPoint_FW-1_Adapter_on_Windows_NT

¶ Stop_CheckPoint_FW-1_Adapter_on_Solaris

¶ Stop_CheckPoint_FW-1_Adapter_on_Solaris

TEC ��$��Check Point FireWall-1 Q"@W?<,$s9H<k5lF*j"?9/rBT9k(sI]

$sH,=.Q_G"k3HrN'7F/@5$#

Windows NT ��Check Point FireWall-1 Q"@W?<r+O9kKO"!Nh&K7^9#

1. Check Point FireWall-1 Q"@W?<r+O9k0K"=_N Check Point FireWall-1

logfile (sHj<rQ<87^9# Check Point FireWall-1 Log Viewer G"VFile (U!$k)W"VPurge (|n)WNgK/jC/7^9#


3. Start_CheckPoint_FW-1_Adapter_on_Windows_NT TEC ?9/r/jC/7"Risk

Manager "@W?<r+O7^9#

Solaris ��Check Point FireWall-1 Q"@W?<r+O9kKO"!Nh&K7^9#

1. Check Point FireWall-1 Q"@W?<r+O9k0K"{8N Check Point FireWall-1



3. Start_CheckPoint_FW-1_Adapter_on_Solaris r/jC/7F" Risk Manager "@W

?<r+O7^9#

Linux ��Check Point FireWall-1 Q"@W?<r+O9kKO"!Nh&K7^9#

1. Check Point FireWall-1 Q"@W?<r+O9k0K"{8N Check Point FireWall-1



3. Start_CheckPoint_FW-1_Adapter_on_Linux r/jC/7F" Risk Manager "@W?

<r+O7^9#

IP ��SAM /i$"sHWar SAM 5<P<Kw.9kKO"!Nh&K7^9#

186 P<8gs 3 jj<9 8


2. CheckPoint_FW-1_by_IP_Address r/jC/7^9#

3. OPSEC SAM 5<P<N"/7gsKjv9k"BT=jN"/7gsr*r7^9#

m: OPSEC SAM 5<P<N NOTIFY "/7gsrXj9klg"VFkWQia<?

<rH$^9#

CheckPoint_FW-1_by_IP_Address ?9/rXj9kH"CjN IP "Il9~1KXj7?

SAM "/7gs,+O5l^9#=N IP "Il9,"\3N=<9"8h""k$O=

<9H8hN>}JN+rXj9k3H,G-^9#

IP WmH3kKO"!NbN,"j^9#

1 : ICMP ($s?<MCH&3sHm<k&aC;<8&WmH3k)

2 : IGMP ($s?<MCH&0k<WI}WmH3k)

3 : GGP (2<H&'$VWmH3k -- HQ9Y-GO"j^;s)

6 : TCP (Aw)fWmH3k)

12 : PUP

17 : UDP (f<6<&G<?0i`&WmH3k)

22 : IDP ($s?<MCH&G<?0i`&WmH3k)

77 : sx0N Net Disk Protocol

255 : $C) IP Q1CH

4. ,WK~8F"!Nm0&*W7gsNf+i",WH9km0*hS"i<HNH_g

o;r*r7^9#

\Ym0 "i<H

\Ym0 "i<HJ7

Wsm0 "i<H

Wsm0 "i<HJ7

m0J7"i<HJ7

5. U!$"&)<k&[9H&^7sN!Npsrj;CH7^9#

3N"/7gs,~;9k^G

NCt

GU)kHMO 0 G9#<mO""/7gsN~;,J$3

Hr(7^9#

IP "Il9N?$W !N*rh,"j^9#

¶ =<9

¶ 8h

¶ =<9^?O8h

IP "Il9 GU)kHMO 0.0.0.0 G9#

6. VSet & Execute (_j & BT)Wr/jC/7"SAM 5<P<XN SAM /i$"s

HWaNw.r+O7^9#

@��!� ��SAM /i$"sHWar SAM 5<P<Kw.9kKO"!Nh&K7^9#


13.C

heck

Po

int

FireW

all-1��

�


2. CheckPoint_FW-1_by_Source_and_Destination r/jC/7^9#

3. OPSEC SAM 5<P<N"/7gsKjv9k"BT=jN"/7gsr*r7^9#

m: OPSEC SAM 5<P<N NOTIFY "/7gsrXj9klg"VFkWQia<?

<rH$^9#

SAM 5<P<N

"/7gs>

TEC ?9/N"/7gs>

"/7gs

WATCH Fk IPaddr HNVGN\3nTO9YF"

Xj5l?m.s0&lYkGm0-?

5l^9#

INHIBIT X_ IPaddr HNVGN\3nTO9YFX

_5l"Xj5l?m.s0&lYkG

m0-?5l^9#

INHIBITCLOSE X_7F/m<: VX_WNH-H1MG9," IPaddrHNVK\3,"kH"=liN\3,

/m<:5l^9#3N"/7gs&?

9/XNQia<?<O"hjC9?9

/NQia<?<H18GJ1lPJj

^;s (~;O|/)#

CANCELWATCH FkNhjC7 CjN VFkW^?O VLNW"/7

gsNzLrhjC7^9#

CANCELINHIBIT X_NhjC7 VX_W"^?O VX_7F/m<

:W"/7gsNzLrhjC7^9#

VX_7F/m<:WG/m<:5lk

\3,"klg"=liN\3OFN)

5l^;s#3N?9/XNQia<?

<O"hjC9?9/NQia<?<H

18GJ1lPJj^;s (?$`"&

HO|/)#

CANCELALL 9YFhjC7 0N"/7gsr9YFhjC7^9#

4. !Nm0&*W7gsNf+i",WH9km0*hS"i<HNH_go;r*r7^

9#

\Ym0 "i<H

\Ym0 "i<HJ7

Wsm0 "i<H

Wsm0 "i<HJ7

m0J7"i<HJ7

5. ,WK~8F"U!$"&)<k&[9H&^7sN!Npsrj;CH7^9#

3N"/7gs,~;9k^GNCt 0 A 300 C^GNMr~O7^9#GU)kHMO 0G9#<mO""/7gsN~;,J$3Hr(7^

9#

=<9 IP "Il9 GU)kHMO 0.0.0.0 G9#

188 P<8gs 3 jj<9 8

8h IP "Il9 GU)kHMO 0.0.0.0 G9#

3N TEC ?9/rFSP9H-N8h

]<H

GU)kHMO 8080 G9#

IP WmH3k GU)kHMO TCP G9#

TCP"ICMP"IGMP"GGP"PUP"UDP"IDP" Net Disk

Protocol"^?O$C) IP Q1CHr^`*r`\G

9#

6. VSet & Execute (_j & BT)Wr/jC/7"SAM 5<P<XN SAM /i$"s

HWaNw.r+O7^9#

Windows NT ��Windows NT G Check Point FireWall-1 Q"@W?<rd_9kKO"!Nh&K7^9#


2. Stop_CheckPoint_Firewall_Adapter_on_Windows_NT r/jC/7F""@W?<r

d_7^9#

3. Check Point FireWall-1 Q"@W?<rFO09k0K"=_N Check Point FireWall-1


Solaris ��Solaris eG Risk Manager U0N TEC ?9/rHCF Check Point FireWall-1 Q"@W?<

rd_9kKO"!Nh&K7^9#


2. Stop_CheckPoint_Firewall_Adapter_on_Solaris r/jC/7F""@W?<rd_7

^9#



Linux ��Solaris eG Risk Manager U0N TEC ?9/rHCF Check Point FireWall-1 Q"@W?<

rd_9kKO"!Nh&K7^9#


2. Stop_CheckPoint_Firewall_Adapter_on_Linux r/jC/7F""@W?<rd_7^

9#




13.C

heck

Po

int

FireW

all-1��

�

��Check Point FireWall-1 QN"@W?<KD$FO"!N`nrj0GT&3H,G-^9#

Check Point FireWall-1 ��2��Solaris eG Check Point FireWall-1 Q"@W?<NG<bsrj0GFO09kKO"!N

H*j~O7^9#

/etc/init.d/rma_cpfw-init start

Windows NT eG Check Point FireWall-1 Q"@W?<N5<S9rj0GFO09kK

O"!NH*j~O7^9#

net start rma_cpfw

Linux eG Check Point FireWall-1 Q"@W?<NG<bsrj0GFO09kKO"!NH

*j~O7^9#

/etc/rc.d/rma_cpfw-init start

Check Point FireWall-1 ��2��Solaris eG Check Point FireWall-1 Q"@W?<NG<bsrj0Gd_9kKO"!NH

*j~O7^9#

/etc/init.d/rma_cpfw-init stop

Windows NT eG Check Point FireWall-1 Q"@W?<N5<S9rj0GFO09kK

O"!NH*j~O7^9#

net stop rma_cpfw

Linux eG Check Point FireWall-1 Q"@W?<NG<bsrj0Gd_9kKO"!NH*

j~O7^9#

/etc/rc.d/rma_cpfw-init stop

9*��Windows NT O"/87?9YFN(i<r Windows NT Event Viewer Kw.7^9#

Solaris O"(i<r SYSLOG G<bsKw.7^9#

Check Point FireWall-1 1��$+&�0��jX(s8sNk<kO"hjr<9]K!N 3 DN0-rM87^9#

¶ =<9 IP "Il9

¶ 8h IP "Il9

¶ 6bN70KAc<

Risk Manager U!$"&)<k&"@W?<N9?<?<&;CHGO"U!$"&)<

k&;s5<N70KAc<O"IAiN"@W?<Gb18G9# Cisco Secure PIX

Firewall Q"@W?<KO"EgYVf,"j^9# Check Point FireWall-1 Q"@W?<K

O"EgYVf,"j^;s#=Neoj"]j7<Nk<kK/~"i<H,djvFil

^9#

190 P<8gs 3 jj<9 8

Risk Manager O" Risk Manager NEgY0- WARNING K Check Point FireWall-1 N"i

<Hr^CW7")fpsr HARMLESS K^CW7^9#3N_jO"cpfw.baroc U!$

kG_j9k3H,G-^9#

��1��$+&�0[HsIN Check Point FireWall-1 m0&l3<IKO IP "Il9,"j^9,"8`*J

6b70KAc<O"j^;s#/~X"N Check Point FireWall-1 m0&aC;<8KX7

F" Risk Manager GO"70KAc<H7F!N9Hjs0,s!5l^9#

fw_conn_deny \3,q]5l^7?#

fw_conn_permit \3,vD5l^7?#

fw_auth_deny f<6<O\3rq]5l^7?#

fw_auth_perint f<6<O\3rvD5l^7?#

��1��$+&�0/~X"J0N Check Point FireWall-1 m0&aC;<8KX7F" Risk Manager GO"7

0KAc<H7F!N9Hjs0,s!5l^9#

fw_control Check Point =.Q9Nlg#

fw_log_switch Check Point m0&U!$kNZjX(^?OQ9Nlg#

fw_log_eof Check Point m0&U!$kN*;Nlg#

�)��6 ��/~X"/i9 RM_Service *hS=N5V/i9 RM_ICMP"^?Os/~/i9

RM_MiscEvent (^?O=N>}) KD$F"cpfw.baroc U!$kKO"EgYlYkr^

a"U!$"&)<kG-NU#<kIr_j9k3H,G-^9#

U!$"&)<kX"NG<?0-KO"!NbN,"j^9#

0- b@ -zJM

cpfw_action U!$"&)<k&GTol

k"/7gs#

Check Point N"/7gsKO"!Nb

N,"j^9#

drop

reject

accept

control (ctl)

=N>

cpfw_additional_info 0-K_j5lF$J$=N

>N Check Point ps#

cpfw_alert Check Point "i<HN?$

W#

![alert]

![userauthalert]

cpfw_ifdir $s?<U'<9N}~# inbound

outbound


13.C

heck

Po

int

FireW

all-1��

�

0- b@ -zJM

cpfw_ifname $s?<U'<9N>0# ether ($<5MCH)

token (H</sjs0)

fddi (U!$P<,6G<?

&$s?<U'<9)

ppp (point-to-point

WmH3k)

atm (s1|

Awb<I)

cpfw_len Q1CH&5$: (P$H

t)#

cpfw_lognum U!$"&)<k&m0&U

!$kK^^lkl3<IN

TVf#

Check Point m0&U!$kNTVf#

cpfw_protocol WmH3k# !N\3WmH3kMN$:l+rdj

vF^9#

TCP

UDP

ICMP

=N>

cpfw_reason ;-ejF#<&"i<HN

Check Point N}3#

cpfw_rule ;-ejF#<&"i<Hr

/85;? Check Point ]

j7<&k<kNVf#

cpfw_type Check Point N$YsH&?

$W#

$YsHN?$WKO"!NbN,"j

^9#

control

alert

user

cpfw_user ;-ejF#<&"i<Hr

z-/37?f<6<#

Risk Manager O" Risk Manager NEgY0- WARNING K Check Point FireWall-1 N"i

<Hr^CW7")fpsr HARMLESS K^CW7^9#

192 P<8gs 3 jj<9 8

Host Intrusion Detection ��


¶ XHost IDS Q Risk Manager "@W?<N5WY

¶ XTEC CorrelationY

¶ 194Z<8NXHost IDS Q"@W?<N$s9H<k*hS=.Y

¶ 196Z<8NXTEC ?9/Y

Host IDS � Risk Manager ��Risk Manager KO"Host Intrusion Detection (Host IDS) Q"@W?<,"j^9#3lKh

j"]n5l?*Zl<F#s0&79F`N!=r;J&3HJ/"=N*Zl<F#s

0&79F`K"@W?<r8+7"p\*Zl<F#s0&79F`N;-ejF#<r/

=9k3H,G-^9#

Host IDS Q Risk Manager "@W?<O"Windows 79F`^?O UNIX 79F`G!P

5l-?5l?$YsHr Tivoli Enterprise Console (TEC) $YsHH^CW7^9# Host

IDS Q Risk Manager "@W?<O"UNIX 79F`NlgKO Tivoli Logfile "@W?<

(syslogd)" Windows 79F`NlgKO Windows Event Log "@W?<rHQ7F$Ys

Hr TEC 5<P<Kw.7^9#

Host IDS Q Risk Manager "@W?<O"Tivoli Logfile "@W?<r=.9k?aNWiC

HU)<`G-NU)<^CH&U!$k+i.j"3lKhj"*Zl<F#s0&79F

`,-?7?$YsHrhj~_"$YsH&5<P<K>w7FjXrT$^9#

Host IDS Q"@W?<O":vN Tivoli Management Enterprise (TME) "@W?<,$s9

H<k5lF$k79F`K"j^9#

TEC CorrelationHost IDS Q"@W?<O"*Zl<F#s0&79F`KhCF-?5lk"/F#SF#

<rFk9k?a"*Zl<F#s0&79F`rbK?<7^9#$YsH,/89kH"

*Zl<F#s0&79F`O79F`&m0KaC;<8rq-~_^9#

Host IDS "@W?<O"!P5l"3liN79F`&m0Kq-~^l?$YsHr"

Tivoli Logfile "@W?<rHCF Risk Manager $YsHKQ97^9#=Ne"$YsH

O$YsH&5<P<Kw.5lFjX,Tol^9#

:v9k Tivoli "@W?<r=.7^9#

14


14.H

ost

Intru

sion

Detectio

n��

�

Windows 79F`Windows Event Log "@W?<r=.7F"Risk Manager U0NU)<^CH&U

!$k os_nt.fmt K\R5lF$k$YsHrâkh&K7^9#

AIX 79F`Tivoli Logfile "@W?< (syslogd) r=.7F"Risk Manager U0NU)<^CH&

U!$k os_aix.fmt K\R5lF$k$YsHrâkh&K7^9#

Solaris 79F`Tivoli Logfile "@W?< (syslogd) r=.7F"Risk Manager U0NU)<^CH&

U!$k os_solaris.fmt K\R5lF$k$YsHrâkh&K7^9#

RedHat 79F`Tivoli Logfile "@W?< (syslogd) r=.7F"Risk Manager U0NU)<^CH&

U!$k os_linux.fmt K\R5lF$k$YsHrâkh&K7^9#

Risk Manager O"*Zl<F#s0&79F`&$YsHH>N Risk Manager "@W?<

KhCF!P5lk$YsHrjX5;""I_K9Hl<?<,/~!N$YsHr4N*

KD.G-kh&K7^9#

Host IDS ��3N;/7gsNjgK>CF"Host IDS Q"@W?<N$s9H<k*hS=.rT$^

9#

��Tivoli Risk Manager Server 3.8 $s9H<k&QC1<8KO" Host IDS Q"@W?<

K,WJU!$k,^^lF$^9#

VTivoli Risk Manager jj<9&N<HWr2H7F"=UH&'"WoKX9kG7ps

HG7N$s9H<kpsrN'7F/@5$#

FWiCHU)<`N TME "@W?<r$s9H<k7F*+J1lPJj^;s#$s9

H<k}!KD$FO"VTivoli Enterprise Console "@W?<&,$IWr2H7F/@5

$#

��+�

TEC $YsH&5<P<eKO"@W?<r$s9H<k7J$G/@5$#=Neoj

K""@W?<r TEC $YsH&5<P<+i[[7F/@5$#Risk Manager U0NW

mU!$krHCF"@W?<r[[9klg""@W?<=.!= (ACF) r$s9H<k

7J1lPJj^;s#"@W?<r$s9H<kG-kNO"(sI]$sH+s Tivoli

N<I@1G9#s Tivoli N<IHO"Tivoli I}j<8gs (TMR) N(sI]$sH7

FjA5lF$J$/i$"sHN3HG9#

Host IDS Q"@W?<O"Tivoli D-N Tivoli (sI]$sH+" Tivoli J0NN<IK

$s9H<kG-^9#

194 P<8gs 3 jj<9 8

Host IDS ��$s9H<ke"U!$kO!NljKV+l^9#

$BINDIR/../generic_unix/RISKMGR/ACF_REP/tecad_snmp.cds


3N*j8JkNU)<^CH&U!$krQ99k0K"PC/"CW&3T<rn.7F

/@5$#

m: UNIX 79F`G Host Intrusion Detection QN Risk Manager "@W?<r=.9kK

O" Risk Manager D-9/jWHK!NQ9rXj7F/@5$#


Tivoli D-G Host IDS Q"@W?<r=.9kKO"!N9FCWrT$^9#

1. U)<^CH&U!$kN`\r*r7F3asH=7"Host IDS Q"@W?<r407

^9# Host IDS Q"@W?<NU)<^CH&U!$krT87^9#

2. Risk Manager "@W?<NU)<^CH&U!$kr Tivoli U)<^CH&U!$kH

^<87" 47Z<8NXRisk Manager H TME "@W?<NU)<^CH&U!$kN

kgYNX(K>CF"/i9jA9F<HasH (.cds) U!$kr8.7^9#

AIX 79Fòs_aix.fmt U!$kr{8N tecad_logfile.fmt U!$kNGeKIC7^9#

Solaris 79Fòs_solaris.fmt U!$kr{8N tecad_logfile.fmt U!$kNGeKIC7^

9#

Windows 79Fòs_nt.fmt U!$kr{8N tecad_nt.fmt U!$kNGeKIC7^9#

Linux os_linux.fmt U!$kr{8N tecad_logfile.fmt U!$kNGeKIC7^

9#

3. $YsH&5<P<GU)<^CH&U!$kr^<8^?Okg7?e" Tivoli "@W

?<=.!= (ACF) rHQ7",ZJU)<^CH&U!$kr[[7F,Q7^9#\

7/O"49Z<8NXACF rHQ7? Risk Manager "@W?<N=.*hS[[Yr2

H7F/@5$#

4. TME "@W?<Kgo;F"!N$:l+rBT7^9#

¶ Windows 79F`Nlg"os_nt.fmt U!$kr,Q7F Windows Event Log "@

W?<r=.9k#

¶ os_aix.fmt U!$kr,Q9k3HKhj" AIX QN Tivoli Logfile "@W?<

(syslogd) r=.9k#

¶ os_solaris.fmt U!$kr,Q9k3HKhj" Solaris QN Tivoli Logfile "@W

?< (syslogd) r=.9k#

¶ Linux Nlg"os_linux.fmt U!$kr,Q7F Tivoli Logfile "@W?< (syslogd)

r=.9k#


14.H

ost

Intru

sion

Detectio

n��

�

ACF rHCF Host IDS Q"@W?<r$s9H<k7F=.9kH""@W?<O+0*

K+O5l^9#=lJeN=.O,W"j^;s,"4HQND-KX8NJ$`\r3a

sH=9k3HKhj" Host IDS Q"@W?<r*sG409k3HOD=G9#Q9rC

(k0K"*j8JkNU)<^CH&U!$kNPC/"CW&3T<rn.9kh&K7

^9#

Risk Manager O"Risk Manager r;CH"CW9kH-K"$YsH&5<P<K"k$Y

sHjAr+0*Km<I7^9#Host IDS Q"@W?<N$YsHO" os.baroc U!$

kGjA5lF$^9#

TEC ��TEC ?9/rH&H"Windows 79F`N(sI]$sHGN;-ejF#<&$YsHN

F:rHQD=KbHQTDKbG-^9# Risk Manager KU09k>N TEC ?9/Nj

9HKD$FO"107Z<8NXRisk Manager TEC N?9/Yr2H7F/@5$#

Windows 79F`Nlg"79F`N*Zl<F#s0&79F`KU09kI}D<k (f

<6< ^M<8c) rH$"79F`G;-ejF#<&$YsHrhj~`+I&+r)

f9k3H,G-^9#

3liN TEC ?9/GO"TEC ?9/rBT7F_k0K" rmt_ntaudit.exe BTD=W

m0i`r(sI]$sHK[[9k,W,"j^9#3NWm0i`r[[9kH-KO"

Risk Manager KU09k Tivoli Windows Host IDS WmU!$kN?9/&WmU!$kr

HQ7F/@5$#

196 P<8gs 3 jj<9 8

McAfee Alert Manager ��


¶ XMcAfee Alert Manager Q"@W?<N5WY

¶ 201Z<8NXMcAfee Alert Manager Q"@W?<N$s9H<k*hS=.Y

McAfee Alert Manager ��Risk Manager KO"McAfee AntiVirus Scanning =JKhj8.5l"McAfee Alert Manager

KhCF}85l?"i<`r TEC $YsHH^CTs09k McAfee Alert Manager QN

"@W?<,^^lF$^9#

3N"@W?<O"MCHo</G McAfee Alert Manager (Anti-Virus Scanning =JN

McAfee Active Virus Defense (AVD) 9$<HNltH7Fs!5lk) rHQ7F$klg

K$s9H<k,D=G9#

&��McAfee Alert Manager O"&#k9N!P"&#k9jAU!$kN97"*hS=N>N

EW$YsHK~z7F McAfee AntiVirus 9-cs=JKhCF8.5l?"i<H&aC

;<8Nf{}8]$sHHJj^9# Risk Manager Event Log "@W?<O"3liN"

i<Hr Windows "Wj1<7gs&$YsH&m0+iI_hj" Tivoli Enterprise

Console (TEC) $YsHH^CW7^9#

Alert Manager O"McAfee NetShield (Windows NT *hS Windows 2000 Q) *hS

McAfee WebShield SMTP (Windows NT *hS Windows 2000 Q) KU07F$^9#

McAfee Alert Manager O"!N McAfee AntiVirus (sHj<&]$sH&9-cJ<Khj

8.5lk"i<H&aC;<8r}87^9#

VirusScanG9/HCWN"sA&#k9&9-cs*hS|n!=rs!7^9# java "W

lCH*hS ActiveX 3sHm<kNG9/HCW&9-cs"E a<k&9-c

s"@&sm<I&U#k?<"$s?<MCH&U#k?<r5]<H7^9#

VirusScan WirelessQ<=Jk&G#8?k&"79?sH&"sA&#k9&9-cs*hS|n!=

rs!7^9#

NetShield5<P<&lYkN"sA&#k9&9-cs*hS|n!=rs!7^9#

15


15.M

cAfee

Alert

Man

ager

��

�

GroupShieldLotus Domino *hS Microsoft Exchange 0k<W&'"&5<P<QN"sA&#

k9&9-cs*hS|n!=rs!7^9#

WebShieldSMTP 2<H&'$QN"sA&#k9&9-cs*hS!=rs!7^9#

McAfee Alert Manager KO"&#k9&9-cs&(s8s+iu.7?"i<H&aC;

<8,=9&#k9&9-cs&$YsHr"I_K9Hl<?<KLN9k?aNaC;<

8s0N}!,$/D+s!5lF$^9#GU)kHH7F" Alert Manager ,$s9H<

k5lF$k Alert Manager Server N Windows $YsH&m0K-?r9k}!,"j^

9#3N79F`O"\qf Alert Manager Server HFPl^9#

McAfee Alert Manager KO McAfee NetShield ,PsIk5lF*j"lL*K 2 DN3s

]<MsHO&K 1 DN5<P<K$s9H<k5l^9#bK?<P]HJk McAfee

NetShield "/F#SF#<NcH7F"&#k9jAU!$kN97d"&#k9&9-c

s&(s8sN"CW0l<I,"j^9#

McAfee Alert Manager *hS McAfee Active Virus Defense 9$<H=JNqAO"J<r

O8aH9k Network Associates, Inc. N Web 5$H+i~j9k3H,G-^9#

http://www.mcafeeb2b.com or http://www.nai.com.

198 P<8gs 3 jj<9 8

��

McAfee Alert Manager QN Risk Manager "@W?<KO"TEC Windows Event Log "@W

?<*hS TEC "@W?<N5]<H&U!$k,^^l^9#3lO!N79F`G5]

<H5l^9#

¶ Windows NT Server

¶ Windows 2000 Server

¶ Windows 2000 Advanced Server

TEC Windows Event Log "@W?<O" Windows "Wj1<7gs&$YsH&m0Kq

-~^l? McAfee Alert Manager &#k9&9-cs&$YsHrhj~_^9# McAfee

Alert Manager O"u1hC?&#k9&9-cs&$YsHr Windows $YsH&m0K

-?7^9 (GU)kH)#

^ 22. McAfee Alert Manager Q"@W?<N3s]<MsH


15.M

cAfee

Alert

Man

ager

��

�

Risk Manager "@W?<&U)<^CH&U!$k rmmac.fmt O"!N3HrT$^9#

¶ $YsH&m0+iI_hk McAfee Alert Manager aC;<8NU)<^CHrjA7

^9#

¶ FaC;<8H TEC $YsH&/i9N^CAs0rT$^9#

¶ aC;<8Npsr"TEC 5<P<,1LD=J$YsHKU)<^CH7^9#

Risk Manager KO BAROC U!$k rmvirus.baroc b^^lF$^9#3lO McAfee

Alert Manager "i<H&aC;<8+in.5lk&#k9I}$YsH&/i9rjA7

^9#3NU!$kO"Risk Manager 5<P< 3.8 $s9H<k&QC1<8NltH7F

$s9H<k5l" TEC k<k&Y<9NltH7F+0*Km<I5l^9#

3liN$YsH&/i9O"&#k9!Pd=N>N McAfee AntiVirus =JN`n$Ys

H (&#k9jAU!$kd&#k9&9-cs&(s8sN97JI) r=7^9#3li

N$YsH&/i9OFQ/i9G"j">N"sA&#k9=JKhk$YsHjAKHQ

9k3H,G-^9#

McAfee Alert Manager �� McAfee NetShield �*��$+&�0

Risk Manager O"McAfee Alert Manager *hS McAfee NetShield Khj8.5l?aC;

<8rhj~_^9#

McAfee Alert Manager GO"9YFN McAfee AntiVirus (sHj<&]$sH&9-cJ<

GHQ5lk"i<H&aC;<8N&L;CH,s!5l^9# McAfee Alert Manager a

C;<8&f<F#jF#<rHQ7F"3liaC;<8N=(*hSQ9,D=G9#

mU:aC;<8NQ9O5EKTCF/@5$#aC;<8O"=JbNu7r?G7F$^9#

aC;<8rQ99k3HKhj"aC;<8,]9H5lk6xHJC?\vNuVr#7

F7^&lg,"j^9#

McAfee Alert Manager P<8gs 4.5 KU09k Risk Manager O"Alert Manager aC;<

8Np\;CHr5]<H7^9#aC;<8NU)<^CHrQ97?lgO"Q9,?G

5lkh&"@W?<&U)<^CH&U!$k rmmac.fmt b979k,W,"j^9#

McAfee Alert Manager rHQ9k3HKhj"D9NaC;<8rHQD= / HQTDK7

?j"EgY4HK-?9kaC;<8r*r9k3H,G-^9#

Risk Manager GO"McAfee NetShield 4.5 Khj8.5lkaC;<8NltN;CHb5

]<H7^9#3liNaC;<8O"McAfee NetShield &#k9&9-cs&3s]<M

sHKX"9kEWJ"/F#SF#<r=7^9#

aC;<8Nj9HKD$FO"301Z<8NXMcAfee Alert Manager *hS McAfee

NetShield "i<H&aC;<8Yr2H7F/@5$#

TEC CorrelationTEC Event Log "@W?<O"McAfee "sA&#k9&9-cs=JKhj8.5l"

Alert Manager Server K>w5lk"i<H&aC;<8r'17^9# McAfee Alert

200 P<8gs 3 jj<9 8

Manager Q"@W?<O"3liN$YsHr TEC $YsHX^CW7^9#$YsHO$

YsH&5<P<Xw.5lFjX,Tol^9#

"sA&#k9&$YsHO9YF"riskmgr.baroc *hS sensor_abstract.baroc GjA

5lF$k Risk Manager $YsH&/i9KpE/bNG9#

McAfee Alert Manager ��McAfee Alert Manager Q Risk Manager "@W?<O"Windows Server G5]<H5l^

9#

��McAfee Alert Manager Q Risk Manager "@W?<r$s9H<k9k0K"!N9FCW

rTCF/@5$#

1. VTivoli Risk Manager jj<9&N<HWr2H7F"=UH&'"Wo*hS$s9H

<kKX9kpsrN'7F/@5$#

2. McAfee Alert Manager Q"@W?<r$s9H<k9k0K McAfee Alert Manager =J

r$s9H<k9k,W,"j^9# McAfee Alert Manager N$s9H<kO"McAfee

NetShield ^?O WebShield =JN$s9H<kNltH7FTol^9#$s9H<k

NjgO"3li=JNI-easF<7gsr2H7F/@5$#

3. McAfee Alert Manager "@W?<r$s9H<k9k0K TME "@W?<r$s9H<

k9k,W,"j^9#$s9H<k}!KD$FO"VTivoli Enterprise Console "@W

?<&,$IWr2H7F/@5$#

m: UNIX 79F`GO McAfee Alert Manager QN Risk Manager "@W?<r=.9k0

K" Risk Manager D-9/jWHK!NQ9rXj7F/@5$#


Tivoli 9��

Risk Manager "@W?<&U)<^CH&U!$kH Windows Event Log "@W?<&U)

<^CH&U!$krkg9k0K" Windows "Wj1<7gs&$YsH&m0+iIN

McAfee "i<H&aC;<8rhj~`+r*r9k3H,G-^9#3lKO"rmmac.fmt

U!$kND9NaC;<8&U)<^CHjAr*r7FT87^9#jgKD$FO"


Tivoli D-G McAfee Alert Manager Q"@W?<r$s9H<k7=.9kKO"J<N?

9/rBT7^9#

1. 47Z<8NXRisk Manager H TME "@W?<NU)<^CH&U!$kNkgYNjg

K>$"Risk Manager "@W?<&U)<^CH&U!$kH TME "@W?<&U)<

^CH&U!$krkg7^9# Tivoli Windows Event Log "@W?<rHQ9klg

O"rmmac.fmt U!$kr{8N tecad_win.fmt U!$kNGeKIC7^9#

2. Tivoli "@W?<=.!= (ACF) rHQ7"U)<^CH=."CDS"*hS70KAc

<&U!$kr=.7F" Tivoli (sI]$sHK[[7^9#49Z<8NXACF rH

Q7? Risk Manager "@W?<N=.*hS[[Yr2H7F/@5$#


15.M

cAfee

Alert

Man

ager

��

�

� Tivoli .��

McAfee Alert Manager "@W?<O"s Tivoli N<IXN$s9H<k*hS=.bD=G

9#s Tivoli N<IHO"Tivoli I}j<8gs (TMR) N(sI]$sH7FjA5lF

$J$/i$"sHN3HG9# 39Z<8NXG-N$s9H<kKhk Risk Manager 3

s]<MsHN$s9H<kY*hSVTivoli Enterprise Console "@W?<&,$IWr2

H7F/@5$#

Windows 2000 �� McAfee Alert Manager ��

McAfee Alert Manager P<8gs 4.5 r Windows 2000 79F`GBT7?lg"1lN&

#k9&9-cs&"/7gsd&#k9!Pu7r-R7?E#9k$YsH&l3<I,

#tN Windows $YsH&m0Kq-~^l^9# Windows Event Log "@W?<O"G

U)kHG9YFN Windows $YsH&m0+i$YsHrhj~_^9#3lKhj"=

l>lN&#k9&9-cs&"/7gsd&#k9!Pu74HK"#tNE#9k Risk

Manager $YsH, TEC 5<P<Kwilk3HKJj^9#3Nu7rr1k?a""W

j1<7gs";-ejF#<"*hS79F`&$YsH&m0N_rbK?<9kh&"

Windows Event Log "@W?<r=.7F/@5$#3lO"!N$:l+N}!KhjT

$^9#

¶ "@W?<=.U!$k tecad_win.conf K!N"@W?<G-N-<o<IrIC9

k#

WINEVENTLOGS=ApplicationLog, SecurityLog, SystemLog

¶ 3^sIT+i Event Log "@W?<rO09k]K -L rXj9k#

tecad_win.exe -L ApplicationLog SecurityLog SystemLog

Windows Event Log "@W?<GG#l/Hj<"DNS 5<P<"^?OU!$k#=5<

P<&$YsH&m0bbK?<9klgO" Risk Manager r5]<H9k"@W?<H1

~KICN"@W?<rBT9k3H,G-^9##tN Event Log "@W?<rBT9k

}!KD$FO"VTivoli Enterprise Console "@W?<&,$IWr2H7F/@5$#

202 P<8gs 3 jj<9 8

Norton AntiVirus ��


¶ XNorton AntiVirus Q"@W?<N5WY

¶ 205Z<8NXNorton AntiVirus Q Risk Manager "@W?<N$s9H<k*hS=.Y

Norton AntiVirus ��Risk Manager KO"Norton AntiVirus =JKhj8.5l?"i<`r TEC $YsHK^C

W9k?aN Norton AntiVirus Q"@W?<,^^lF$^9#

&��Symantec Norton AntiVirus Corporate Edition 7.0 ^?O 7.5 =JO"-AJ ActiveX 3<I

d Java "WlCH"5iKOHm$NZOJIrI."$s?<MCH&5<U#s~N]

nrT$^9#3lKhj"#(J&#k9KP7FG"CFb"5]<H5lF$kWiC

HU)<`Gj"k?$`N]n,Tol^9#

Norton AntiVirus N$YsHKD$FO"Symantec Web 5$HK-\5lF$^9#!N

Web 5$Hr2H7F/@5$#

http://service1/symantec.com/SUPPORT/nav.nsf/

VNorton AntiVirus Corporate Edition Event IDs ExplainedWKX9kpsr~j9k3H,G

-^9#

16


16.N

orto

nA

ntiV

irus

��

��

�

��

Norton AntiVirus QN Risk Manager "@W?<KO"TEC Windows Event Log "@W?<

*hS TEC "@W?<N5]<H&U!$k,^^l^9#

3lO!N79F`G5]<H5l^9#

¶ Windows NT

¶ Windows 2000

TEC Windows Event Log "@W?<O" Windows "Wj1<7gs&$YsH&m0Kq

-~^l? Norton AntiVirus &#k9&9-cs&$YsHrhj~_^9# Norton

AntiVirus O"GU)kHG&#k9&9-cs&$YsHr$YsH&m0K-?7^9#

Risk Manager "@W?<&U)<^CH&U!$k rmnav.fmt O"!N3HrT$^9#

^ 23. Norton AntiVirus Q"@W?<+iNG<?&Um<

204 P<8gs 3 jj<9 8

¶ $YsH&m0+iI_hk Norton AntiVirus aC;<8NU)<^CHrjA7^9#

¶ FaC;<8H TEC $YsH&/i9N^CAs0rT$^9#

¶ aC;<8Npsr"TEC 5<P<,1LD=J$YsHKU)<^CH7^9#

3NU!$kO TEC "@W?<H&K"Norton AntiVirus 5<P<H18WiCHU)<`

K$s9H<k5l^9#

Risk Manager KO BAROC U!$k rmvirus.baroc b^^lF$^9#3lO Norton

AntiVirus "i<H&aC;<8+in.5lk&#k9I}$YsH&/i9rjA7^

9#3NU!$kO"Risk Manager Server N$s9H<kfK$s9H<k5l" TEC k

<k&Y<9NltH7F+0*Km<I5l^9#

3liN$YsH&/i9O"&#k9!Pd=N>N Norton AntiVirus =JN`n$Ys

H (&#k9jAU!$kd&#k9&9-cs&(s8sN97JI) r=7^9#3N$

YsH&/i9OFQ/i9G"j">N"sA&#k9=JKhk$YsHjAKHQ9k

3H,G-^9#

Norton AntiVirus ��Risk Manager O"Norton AntiVirus P<8gs 7.0 ^?O 7.5 Ks!5lk$YsH&aC

;<8r5]<H7^9#$YsH ID VfKhj1L5lk!N Norton AntiVirus $Ys

HO" Risk Manager rmnav.fmt U)<^CH&U!$kKhCFhj~^l^9#

$YsHVf $YsHNEgY 88?3H

2 LN &#k9&9-cs,0;7^7?#

3 LN &#k9&9-cs,+O7^7?#

5 Yp 6wU!$k,+U+j^7?#

6 Yp CjNU!$kr+/H-K"(i<,/87^7?#

7 LN &#k9jANm<I,Tol^7?#

13 LN Norton AntiVirus 5<S9,7cCH@&s5l^9#

14 LN Norton AntiVirus 5<S9,+O5l^9#

16 LN jAN97,@&sm<I5l^9#

21 (i< &#k9&9-cs,GAZil^7?#

TEC CorrelationTivoli Event Log "@W?<O"Norton AntiVirus Khj8.5lk&#k9X"$YsHr

'17^9# Norton AntiVirus Q"@W?<O"3liN$YsHr TEC $YsHX^C

W7^9#!$G"$YsH&5<P<Xw.5lFjX5;il^9#

"sA&#k9&$YsHO9YF"riskmgr.baroc *hS sensor_abstract.baroc GjA

5lF$k Risk Manager $YsH&/i9KpE/bNG9#

Norton AntiVirus � Risk Manager ��

3N;/7gsGO"Norton AntiVirus Q Risk Manager "@W?<N$s9H<k*hS=

.}!KD$Fb@7^9#


16.N

orto

nA

ntiV

irus

��

��

�

��Norton AntiVirus Q Risk Manager "@W?<r$s9H<k9k0K"!N9FCWrTC

F/@5$#

1. VTivoli Risk Manager jj<9&N<HWr2H7F"=UH&'"WoKX9kpsH

$s9H<kpsrN'7F/@5$#

2. Norton AntiVirus Q Risk Manager "@W?<r$s9H<k9k0K"Symantec Norton

AntiVirus =Jr$s9H<k7^9#=JKX9kb@K>CF/@5$#

3. Norton AntiVirus Q"@W?<r$s9H<k9k0K"HQ9kWiCHU)<`QN

TME "@W?<r$s9H<k7^9#$s9H<kNX(KD$FO"VTivoli

Enterprise Console "@W?<&,$IWr2H7F/@5$#

m: UNIX 79F`GO Norton AntiVirus QN Risk Manager "@W?<r=.9k0K"

Risk Manager D-9/jWHK!NQ9rXj7F/@5$#


Tivoli 9��Risk Manager "@W?<&U)<^CH&U!$kH Windows Event Log "@W?<&U)

<^CH&U!$krkg9k0K" Windows "Wj1<7gs&$YsH&m0+iIN

Norton AntiVirus $YsHrhj~`+r*r9k3H,G-^9#3lKO"rmnav.fmt U

)<^CH&U!$kKjA5l?D9NaC;<8&U)<^CHjAr*r7FT87^

9#\7/O"VTivoli Enterprise Console "@W?<&,$IWr2H7F/@5$#

Tivoli D-G Norton AntiVirus Q"@W?<r$s9H<k7=.9kKO"J<N?9/

rBT7^9#

1. Risk Manager "@W?<&U)<^CH&U!$kH TME "@W?<&U)<^CH&

U!$krkg7^9#\7/O"47Z<8NXRisk Manager H TME "@W?<NU)

<^CH&U!$kNkgYr2H7F/@5$#Tivoli Windows Event Log "@W?<

rHQ9klgO" rmnav.fmt U!$kNbFr{8N tecad_win.fmt U!$kK^<

87^9#

2. Tivoli "@W?<=.!= (ACF) rHQ7"U)<^CH"=."CDS"*hS70KA

c<&U!$kr=.7F" Tivoli (sI]$sHK[[7^9#49Z<8NXACF r

HQ7? Risk Manager "@W?<N=.*hS[[Yr2H7F/@5$#

� Tivoli .��Norton AntiVirus Q"@W?<O"s Tivoli N<IXN$s9H<k*hS=.bD=G

9#s Tivoli N<IHO"Tivoli I}j<8gs (TMR) N(sI]$sH7FjA5lF

$J$/i$"sHN3HG9# 39Z<8NXG-N$s9H<kKhk Risk Manager 3

s]<MsHN$s9H<kY*hSVTivoli Enterprise Console "@W?<&,$IWr2

H7F/@5$#

Windows 2000 �� Norton AntiVirus ��Norton AntiVirus P<8gs 7.5 r Windows 2000 79F`GBT7?lg"1lN&#k

9&9-cs&"/7gsd&#k9!Pu7r-R7?E#9k$YsH&l3<I,#t

N Windows $YsH&m0Kq-~^l^9# Windows Event Log "@W?<O"GU)

kHG9YFN Windows $YsH&m0+i$YsHrhj~_^9#3lKhj"=l>

lN&#k9&9-cs&"/7gsd&#k9!Pu74HK"#tNE#9k Risk

Manager $YsH, TEC 5<P<Kwilk3HKJj^9#

206 P<8gs 3 jj<9 8

3Nu7rr1k?a""Wj1<7gs";-ejF#<"*hS79F`&$YsH&m

0N_rbK?<9kh&" Windows Event Log "@W?<r=.7F/@5$#3lO"

!N$:l+N}!KhjT$^9#

¶ "@W?<=.U!$k tecad_win.conf K!N"@W?<G-N-<o<IrIC9

k#

WINEVENTLOGS=ApplicationLog, SecurityLog, SystemLog

¶ 3^sIT+i Event Log "@W?<rO09k]K -L rXj9k#

tecad_win.exe -L ApplicationLog SecurityLog SystemLog

Windows Event Log "@W?<GG#l/Hj<"DNS 5<P<"^?OU!$k#=5<

P<&$YsH&m0bbK?<9klgO" Risk Manager r5]<H9k"@W?<H1

~KICN"@W?<rBT9k3H,G-^9##tN Event Log "@W?<rBT9k

}!KD$FO"VTivoli Enterprise Console "@W?<&,$IWr2H7F/@5$#


16.N

orto

nA

ntiV

irus

��

��

�

208 P<8gs 3 jj<9 8

Network IDS

3NOGO"Network Intrusion Detection System KD$Fb@7^9#Network Intrusion

Detection System (Network IDS) O"MCHo</&Y<9N/~!N79F`G9#\ON

bFO"!NH*jG9#

¶ XNetwork IDS N5WY

¶ 210Z<8NXNetwork IDSTEC CorrelationY

¶ 212Z<8NXNetwork Intrusion Detection System N$s9H<k*hS=.Y

¶ 213Z<8NXRisk Manager TEC ?9/Y

¶ 216Z<8NXnids 3^sIY

¶ 218Z<8NXNetwork IDS 6b70KAc<Y

Network IDS N6b70KAc<O 307Z<8NXNetwork IDS 6b70KAc<YKj9

H7^9#Network IDS aC;<8O 237Z<8NXNetwork Intrusion Detection System Na

C;<8YK-\7^9#

Network IDS ��Network IDS OMCHo</&HiU#C/r listen 7F"9-csdB]N/~6bJI

-UN"k"/F#SF#<N'urTA^9#Lo"Network IDS O"U!$"&)<kN

90b&+0&N1lNlQ^7sGT/7"$s?<MCH+ie.9k/~nTrFk7

^9# Network IDS O"UNIX 79F`eGT/7^9#

Network IDS O"i<`r8.7F"3lr Tivoli Management Enterprise (TME) "@W?<

K]9H7^9#3lO UNIX 79F`QN Tivoli Logfile "@W?< (syslogd) G9#

Network IDS U)<^CH&U!$k (nids.fmt) O"Tivoli Logfile "@W?<r=.7F"

Logfile "@W?<,3liN"i<`r TEC $YsHK^CWG-kh&K7^9#

Network IDS O"Tivoli Logfile "@W?<H18(sI]$sHKos7^9#

Network IDS O(?b<IGBT7F"MCHo</eN9YFNN<IVHNHiU#C/

rFk9k3H,G-^9# Network IDS O"CjN5<P<eGN_BT9k3HKhj

s(?b<IGBT9k3HbG-^9#3lKhj"=N5<P<r8hH9kHiU#C

/N_rFk7^9#s(?b<IO"1lNN<I+iNHiU#C/rFk9kN,TD

=^?Os=B*G"k9$CA&MCHo</d6b.MCHo</K*$Fr)A^9#

17


17.N

etwo

rkID

S

Network IDSTEC CorrelationNetwork IDS O"MCHo</eN"/F#SF#<rbK?<7"=lr=[5lk6bN

{NNQ?<s (70KAc<) HM-go;^9#Network IDS OlW9kbNr+U1k

H"79F`&m0KaC;<8rq-~_^9# Tivoli Logfile "@W?<O"$YsHr

$YsH&5<P<Kw.7^9#

Risk Manager O Network IDS $YsHr">N?$WN;s5<+iw.5lk=N>N$

YsHHX"U1" Risk Manager "I_K9Hl<?<,/~!N$YsH4NrD.G-

kh&K7^9#

^ 24. Network Intrusion Detection System N^

210 P<8gs 3 jj<9 8

Network IDS �*�Network IDS Gsp5lk"i<HKO"!Nps,^^l^9#

¶ G-N1LVf

¶ EgYlYk

¶ F-9H-R

Network IDS O1L (ID) VfrHQ7F"i<Hr1L7+,1^9# ID VfO"

Common Vulnerability Entry (CVE) VfKOP~7F$^;s#3lO"Network IDS OHe

-J0N;-ejF#<dj (=.(i<"PC/&I""9-csKs0JI) KD$Fb

F9H7"FQ-N"kAG6br'17h&H9k?aG9#

?H(P"Network IDS KO"lL*JPCU!<&*<P<Um<&G<?r!P9k?a

N 3 DN70KAc<,"j^9#3liN*<P<Um<&70KAc<O"t4KZV

CVE G-NPCU!<&*<P<Um<6br-cCA7^9# Network IDS O"iaF!

P7 CVE KOP?5lF$J$70KAc<G"CFbFQN70KAc<H7F7$"$

+JkPCU!<&*<P<Um<Gb-cCAG-kh&K7F$^9#70KAc<,F

Q*G"k3H+i"Network IDS GO6b5lF$kPCU!<&*<P<Um<NHe-

r5NKhL9k3HOG-^;s#

[HsINlg"X"9kHe-r5NK1L9khjO"6b,TolF$k3HrNBK

Nk3HN},EWG9#

CVE (sHj<K5NKP~7J$ Network IDS 70KAc<QK"Network IDS GO"

l]<H&9Hjs0Nh,K CVE 2H ID ,U$F$^9#=l>lN CVE ID N\Y

KD$FO"!r2H7F/@5$#

http://csrc.nist.gov/icat

Network IDS OEgYlYkr0tMH7FXj7^9#<m (0) Oj9/NEgY,c$

3Hr(7"M,}(kKDl"hjEgJu7r=7^9#

"i<HNF-9H-RO""i<Hr+F4j<=9k-<o<IG+O5l^9#"i<

HN+F4j<O!NH*jG9#

-<o<I b@

CVE CVE G<?Y<9Kj9H5lkG-NHe-#

ALERT CVE Kj9H5lF$J$FQN6b#

DOS {NN5<S9826b#

SCAN 6b0N4:r(9HiU#C/&Q?<s#

CONFIG ;-ejF#<X"N=.(i<rHQ7h&H9kn_#

AUTH 6br(9D=-,"k'ZN:T#

BACKDOOR {NNPC/&I"&Wm0i`VHNHiU#C/#

STEALTH {NN9Fk96bK*$FlL*JHiU#C/#

Network IDS GO"!N 2 DN+F4j<N!P,Tol^9#

H_~_"i<H

H_~_"i<HO"Network IDS KhCF;C7gs^?OQ1CH&G<?K*


17.N

etwo

rkID

S

1k1cJQ?<sr5w9k@1GO!PG-J$u7r7$^9#3liN"i

<HGO"WmH3kbN9F<HUkj_nQr4Y?j"#tN;C7gsKO

CF,OrT&,W,"j^9# Network IDS KO"3liNF9H,O<I3<

G#s05lF$^9#3lrQ99k3HOG-^;s#

Network IDS O"3liNH_~_"i<HNPO9Hjs0*hSEgYlYkr

ids.msg U!$kKXj7F$^9#

70KAc<&Y<9N"i<H

70KAc<&Y<9N"i<HNlg" Network IDS OjjNWmH3k&lY

kK*1kQ1CH^?O;C7gs&G<?&9Hj<`bNXjQ?<sr!P

7^9# Network IDS O"3li70KAc<NQ?<s""i<HN%hgL"

*hSPOaC;<8r ids.rules U!$kKXj7F$^9#

Risk Manager N ids.rules U!$kO Tivoli Support Web 5$HGj|*K975lF*

j"3NU!$krG7N70KAc<&U!$kKV-9(k3H,G-^9#\7/O"

214Z<8NX70KAc<&U!$kN97Yr2H7F/@5$#

Network Intrusion Detection System ��Network IDS r$s9H<k9kKO"$s9H<kK3$F"=.rT&,W,"j^9#

Network Intrusion Detection Option ��+/�0Network Intrusion Detection System =JKO"CD NeLG#l/Hj<K$s9H<k&Q

C1<8,^^lF$^9#3lKO!N$s9H<k&b8e<k,^^l^9#

¶ Network Intrusion Detection Option 3.8

3NQC1<8KO"Network IDS ,^^l^9#^?"!N Network IDS *hS Risk

Manager correlation $YsH&5<P<&U!$kb^^l^9#

v correlation k<k&U!$k"prolog U!$k"*hS=.U!$k

v Logfile "@W?<=.QNU)<^CH&U!$k

v GU)kHN=.U!$k

m: Network IDS BAROC U!$k (nids.baroc) O"Tivoli $s9H<k&QC1<8K^^

l^9#

3NQC1<8r"Tivoli D-N(sI]$sHK$s9H<k7^9#s Tivoli D-K$

s9H<k9klgO"79F`NM$F#VN$s9H<k&Wm0i`rHQ7^9#

s Tivoli D-XN Risk Manager N$s9H<k}!KD$FO"VTivoli Risk Manager f

<6<:&,$IWr2H7F/@5$#

��$s9H<kN0K"VTivoli Risk Manager jj<9&N<HWr2H7F"=UH&'"


nids.fmt U!$kKhj TME "@W?<r=.9k0K"Network IDS ;s5<r$s9

H<k9k,W,"j^9#

212 P<8gs 3 jj<9 8

Tivoli Logfile ,$s9H<kQ_G"k,W,"j^9#$s9H<kNX(KD$FO"


Network IDS Q"@W?<O"Tivoli (sI]$sH^?Os Tivoli N<IK$s9H<k

9k3H,G-^9#

Network IDS ��Network IDS r=.9kKO"!N9FCWrT$^9#

��+�Network IDS N=.O"m<+kK"^?O"@W?<=.!= (ACF) rHQ7FT&3H

,G-^9#

¶ ,WK~8F ids.cfg =.U!$krT87^9#f{Nm1<7gsG=.rT&lg

O"ACF rHQ7FU!$krF[[7F/@5$#

¶ 975l?70KAc<&U!$k,HQD=JlgO",WK~8F"70KAc<&

U!$k (ids.rules) rV-9(F977^9#b@KD$FO"214Z<8NX70K

Ac<&U!$kN97Yr2H7F/@5$#

¶ =.,0;7?e"Risk Manager Ks!5lk Tivoli Enterprise Console (TEC) ?9/r

HQ7F"Network IDS rO07^9# XNetwork IDS "@W?<N+OYr2H7F

/@5$#

Risk Manager TEC ��Risk Manager KO"Tasks for Enterprise Risk Management H$&H+N?9/&i$Vij


HN TEC ]j7<&j<8gsK$s9H<k7^9#

Network IDS TEC ��Risk Manager KO"Network IDS rO0 / d_9k?aN TEC ?9/,^^lF$^9#

Network IDS ��

Network IDS r+O9kKO"!Nh&K7^9#

1. MCHo</&$s?<U'<9+iQ1CHrI_hkKO"k<HH7F Network

IDS rBT9k,W,"j^9#@sW&U!$k+iI_hklgO"k<H"BO,

W"j^;s#


3. Start_NIDS_Adapter TEC ?9/r/jC/7^9#

Network IDS ��

Network IDS rd_9kKO"!Nh&K7^9#


2. Stop_NIDS_Adapter TEC ?9/r/jC/7^9#


17.N

etwo

rkID

S

Network IDS ��Tivoli "I_K9Hl<?<O"J<N?9/rT$^9#

nids '!�� Network IDS ��Network IDS N$s9H<kKhj"Inittab U!$kKO"79F`N/0~K Network

IDS r+0*KO09k?aNT,IC5l^9#$s9H<k&Wm0i`O"Lo"!N

h&K rc V<H~9/jWH, Network IDS r+0*KO09kh&;CH"CWrT$

^9#

cd /usr/opt/Tivoli/nids; ./nids -q -d

F`\O"!NH*jG9#

-q E_b<IrXj7^9#8`POK"i<HOwil^;s#GU)kH&b<I

GO"8`POK"i<H,u~5l^9#

-d Wm;9rG<bsH7FBT7J$h&Xj7^9#G<bsH7FBT7J$3

HKhj"init G<bs, Network IDS Wm;9rbK?<7"Wm;9,:T7?

lgKOWm;9rFO07^9#

��Network IDS N$s9H<kKhj"Inittab U!$kKO"Network IDS r+0*KO0

9k?aNT,IC5l^9#

Network IDS r+0*KO07J$h&K9kKO"Inittab U!$kfNTNh,K3ms

(:) rU1F"O0?ar3asH=7^9#

��3<:��)��Risk Manager N Network IDS 70KAc<&U!$kO""/;9)f5l? Tivoli

Support Web 5$HGj|*K975lF$^9#

Tivoli D-N70KAc<&U!$krV-9(kKO"!Nh&K7^9#

1. ids.rules *hS=N>,WJU!$kr!N Tivoli Support Web 5$H+i@&sm<

I7^9#


2. ACF rHQ7F77$P<8gsN70KAc<&U!$kr[[7"lP<8gsNU

!$krV-9(^9#

s Tivoli D-G70KAc<&U!$krV-9(kKO"!Nh&K7^9#

1. !N9/jWH&U!$krBT7F"Network IDS G<bsrd_7^9#

stopnids

2. ids.rules *hS=N>,WJU!$kr!N Tivoli Support Web 5$H+i@&sm<

I7^9#


3. !N9/jWH&U!$krBT7F"Network IDS G<bsrFO07^9#

startnids

214 P<8gs 3 jj<9 8

Network IDS �*��1?��Network IDS GO""i<H*hSm.s0psr!N 3 DNLVKwk3H,G-^9#

¶ Syslog

¶ m<+k&U!$k

¶ 3s=<k (8`POrWm;9KHQ)

a$sN ids.cfg =.U!$kK"3^sITK*1k3li8hN*rrXj9k3H,

G-^9# ids.cfg U!$kO"GU)kHNm.s0&m1<7gsr_j7^9#GU

)kHGO"m0psO$YsH&3s=<kKN_wil^9#

Network IDS O ids.cfg U!$kKGU)kHrXj7^9,"GU)kHNXjrQ99

k3H,G-^9#3lKO"3^sITG nids -y *W7gsrXj7F syslog POr/

)"^?O nids -q *W7gsKhj3s=<kPOr*UK7^9# Risk Manager G

O"LoO3liN9$CArXj7FPOr syslog Kwkh&K7" Network IDS G

/usr G#l/Hj<Kn.5lkU!$kN5$:,}C9k3HNJ$h&K7F$^

9#

GU)kHGO"m0psO syslog KN_wil^9#

�� %��9YFNMCHo</&$s?<U'<9,(?b<IN*Zl<7gsr5]<H9ko1

GO"j^;s#CK"ltN ISA *hSl0N PCMCIA H</sjs0&+<IGO(

?b<IKhk5Nr5]<H7^;s#O<I&'",(?b<IN*Zl<7gsr5]

<H9k+I&+rF9H9kKO" tcpdump rBT7F"m<+k&[9HVGNdj

HjGOJ$Q1CH"^?^kA-c9H"k$OVm<I-c9HGOJ$Q1CHr!

P7^9#

IP ��Network IDS ,QC7VlQN$s?<U'<9G listen 9kHXxJlg,"j^9#3

N$s?<U'<9O"Q1CHr>w7J$;0asHGODkHJiJ$$s?<U'<

9rU#7^9#QC7VlQN$s?<U'<9NcH7FO"$s?<U'<9,0t

(U!$"&)<k0) ;0asHKQC7VK\35lF*j"h 2 N$s?<U'<9,

bt;0asHG"/F#VJuVG Network IDS "i<HrU!$"&)<kbN Risk

Manager Kspr9ku7,"j^9#

Network IDS rQC7V&$s?<U'<9eGBT9kKO"$s?<U'<9r"CW&

b<IQK=.9k,W,"j^9,"$s?<MCH&WmH3k (IP) "Il9Odjv

F^;s#

ifconfig up 3^sIrHQ7F"IP "Il9NXjrJ,7F/@5$#$s?<U'<

9,"CW&b<IG"kVO"MCHo</GN IP "Il9ps,J$?a"Q1CH>

wOTol^;s# Network IDS O"@&suVN$s?<U'<9GO listen 7^;s#

5��Network IDS O"Risk Manager Kwilk"i<HK";s5<&[9HN IP "Il9"

*hS04$~5l?[9H> (c"host.company.com) rH_~_^9#04$~5l?[

9H>O"Risk Manager K*$F"i<HN=<9>rG-NbNH9keGEWHJj^

9# Network IDS ,04$~[9H>rh@G-kh&K9kKO"m<+kNj>kP<


17.N

etwo

rkID

S

,04$~>r gethostbyaddr( ) HqKa9h&=.9k,W,"j^9#Lo

O"/etc/hosts U!$kbNm<+k&[9HKP7=.rT$^9 (eX*KIa$s&

M<`&79F` (DNS) ^?OMCHo</ps5<S9 (NIS) KhkbNG"klgG

b)#\YKD$FO"resolver man Z<8r2H7F/@5$#

nids '!��Network IDS rj0GO0"^?O=N>*W7gsrHQ9kKO"!N=8G nids 3^

sIrHQ7^9#

nids [-a]

[-c config_filename]

[-d]

[-f filename]

[-i interface]

[-m msgfile]

[-o outfile]

[-q]

[-y]

[-r sigfile ]

[-s char]

[-v value]

[-M size]

[-K]

[-P]

[-S num_packets]

[-R]

[-T]

[-V]

F`\O"!NH*jG9#

-a $<5MCH^?OH</sjs0&HiU#C/NaG#"&"/;9)f

(MAC) "Il9r=(7^9#GU)kHO OFF G9#Lo"Network IDS

O=<9H8hN$s?<MCH&WmH3k (IP) lYkN"Il9ru~

7^9#3N*W7gsKhj"MAC (*}lYkN"Il9) Nu~,IC

5l^9#

-c config_filename

eX=.U!$k>rXj7^9#GU)kH>O ./ids.cfg G9#

-d Wm;9rG<bsH7FBT7J$h&Xj7^9#G<bsH7FBT7

J$3HKhj"init G<bs, Network IDS Wm;9rbK?<7"Wm

;9,:T7?lgKOWm;9rFO07^9#

-f filename Network IDS ,"MCHo</N5NGOJ/"U!$k+iG<?rI_

hlkh&K7^9# Network IDS O"8`PON tcpdump U!$k"^

?O nids -o *W7gsG@sW7?Q1CHrI_hk3H,G-^9#

=NeG"3liNU!$kr/~70KAc<QKh}7^9#

-i interface HQ9k$s?<U'<9rXj7^9#GU)kHO"GiNsk<WPC

216 P<8gs 3 jj<9 8

/&$s?<U'<9G9# Network IDS O"k<WPC/&$s?<U'

<9"*hS$<5MCH^?OH</sjs0&$s?<U'<9G listen

9k3H,G-^9#[9HK#tN$s?<U'<9,"klg"bK?<

P]NFMCHo</&$s?<U'<9KD- 1 D:D"#t3T<N

Network IDS rBT9k3H,G-^9#

-m msgfile eXN"i<H&aC;<8&U!$krXj7^9#GU)kHNaC;<

8&U!$kO ./ids.msg G9# ids.msg U!$kO"H_~_"i<HQ

NPOaC;<8&9Hjs0rs!7^9# Network IDS GO"70KA

c<&Y<9N"i<HQNaC;<8&9Hjs0, ids.rules U!$k

Ks!5l^9," ids.rules U!$krT89k3HOG-^;s#

-o outfile Q1CH&m0&U!$k>rXj7^9#GU)kHGO"Q1CHNm.

s0rT$^;s#e+i nids -f *W7gsrHQ7FQ1CH&m0&

U!$krh}9k3H,G-^9#

-q E_b<IrXj7^9#8`PO (stdout) K"i<HOwil^;s#G

U)kH&b<IGO"8`POK"i<H,u~5l^9#

-y syslog b<IrXj7^9#3Nb<IKhCF"i<HO syslog Kwil

^9#GU)kHGO""i<HO syslog Kwil^;s#Risk Manager N

LoNQ!GO" ids.cfg U!$kKhj""i<Hr syslog Kwkh&

Xj7^9# ids.cfg KXj5l?0nKhj"GU)kHN"/7gsr

Q97^9#"i<Hr syslog KwiJ$h&K9kKO"ids.cfg U!$

krQ99k,W,"j^9#

-r sigfile eXNk<k&U!$k>rXj7^9#GU)kHNk<k&U!$kO"

ids.rules"^?O ids.cfg U!$kGXj5l?U!$kG9#k<k&U

!$kO"DQN70KAc<&Y<9N"i<H&k<krXj7"POa

C;<8NXjbT$^9#

-s char "i<HNU#<kIhZj8zrXj7^9 (c"\n \t \0x0a JI)#G

U)kHNhZj8zO \n G9#

-v value 3s=<kK"i<Hr=(7^9 (>= value)#GU)kHO 0 G"Network

IDS O"i<Hr=(7^9#QKK9-csKs0,TolkMCHo<

/K*1k;s5<Nlg"3NMrb/_j7"cj9/N"i<HNLr

:i93H,G-^9#

-M size $s?<U'<9NGg>wfKCH (MTU) rXj7^9#GU)kHO

1500 MTU G9#

-K Network IDS r kill ^?OG<bs&Wm;9NBTrd_7"*;7^

9#

-P s(?b<IGBTr7^9#GU)kHO"(?b<IGNBTG9#Lo

O Network IDS rlQN^7sGBT7"MCHo</&HiU#C/r(

?b<IG9-cs7^9#^?"Network IDS rB05<P<eGs(?

b<IGBT9k3HbG-^9#3Nlg"Network IDS Om<+k&[

9HVHNQ1CHN_r!:7^9#s(?b<IGBT9k3HKhj"

Network IDS GOm<+k&[9HK++km<I,g}Ko:5l^9#

-S num_packets

BTfNGP$9}Wr=(7^9#GU)kHGO"}WOTol^;s#


17.N

etwo

rkID

S

-R Network IDS G<bs&Wm;9rFO07^9#Network IDS Wm;9,

G<bsH7FBT5lF$klg" nids -R 3^sIrFYBT9kH

Network IDS G<bs&Wm;9,FO05l" 2 V\N nids 3^sI,*;7^9#

-T GU)kHMGOH</sjs0&b<Ir/)7J$?a"H</sjs0

h}N/)KHQ7^9#Lo"Network IDS O$s?<U'<9,H</

sjs0G"k+I&+r+0*K=L7^9#lgKhCFO"3l,!P

5lJ$lg,"j^9#3NlgO"3N*W7gsrHQ7Fh}r/)

7^9#

-V Network IDS P<8gs*hS|UpsN=(KHQ7^9#

Network IDS ��3<:�Network IDS O ID VfrHQ7F"i<HrlU*K1L7^9#3liNVfO"

Common Vulnerability Entry (CVE) VfKOP~7F$^;s#3lO"Network IDS OHe

-J0N;-ejF#<dj (=.(i<"PC/&I""^?O9-csKs0) KD$F

bF9H7"G-k@1FQ-N"kAG6br'17h&H9k?aG9# CVE (sHj

<K5NKP~7J$ Network IDS 70KAc<KD$F Network IDS GO"l]<H&

9Hjs0Nh,K CVE 2H ID ,U$F$^9#

=l>lN CVE ID N\YKD$FO"!r2H7F/@5$#

http://csrc.nist.gov/icat/vulnerabilities/CVE_IDnumber.

Network IDS OEgYlYkr0tMH7FXj7^9#<m (0) Oj9/NEgY,c$


Network IDS GO"H_~_"i<HH70KAc<&Y<9N 2 DN+F4j<N!P,

Tol^9#

�%%�*�H_~_"i<HO";C7gs^?OQ1CH&G<?K*1k1cJQ?<sN!Pr5

w9k3HGO!PG-J$u7r7$^9#3liN"i<HGO"WmH3kbN9F<

HUkj_nQr4Y?j"#tN;C7gsK*hS,OrT&,W,"j^9#3liN

F9HO"Q99k3HOG-^;s#

Network IDS O"3liNH_~_"i<HNPO9Hjs0*hSEgYlYkr ids.msg

U!$kKXj7F$^9#

H_~_"i<HNj9HKD$FO"307Z<8NXNetwork IDS H_~_"i<HYr2

H7F/@5$#

��3<:��*�70KAc<&Y<9N"i<HNlg" Network IDS OjjNWmH3k&lYkK*1

kQ1CH^?O;C7gs&G<?&9Hj<`bNXjQ?<sr!P7^9# Network

IDS O"3li70KAc<NQ?<s""i<HN%hgL"*hSPOaC;<8r

ids.rules U!$kKXj7F$^9#

218 P<8gs 3 jj<9 8

70KAc<&Y<9N"i<HNj9HKD$FO"309Z<8NX70KAc<&Y<9

N"i<HYr2H7F/@5$#


17.N

etwo

rkID

S

220 P<8gs 3 jj<9 8

Tivoli Decision Support


¶ Tivoli Decision Support for Enterprise Risk Management N5W

¶ $s9H<k*hS=.ps

¶ BTG-kjgNj9H

Tivoli Decision Support for Enterprise Risk Management ��Risk Manager N Tivoli Decision Support for Enterprise Risk Management 3s]<MsHO"

Tivoli $YsH&3s=<k (TEC) Ksp5l? Risk Manager $YsHKX9kzrps

r8s7Fs!7^9#

Tivoli Decision Support for Enterprise Risk Management rHQ7F"!NvArT&3H,G

-^9#

¶ $YsH&G<?Y<9+iN;-ejF#<&$YsH&G<?N}8N+0=

¶ zr$YsH("9~"T</&\je<`"$YsH&?$W"*hS$YsHN=<

9KX9kAdNsz

¶ #!5N^AA0GNzrpsN=(

Tivoli Decision Support for Enterprise Risk Management O"9YFN"@W?<G!=7^

9#

psO"@0iU^?OF-9H&l]<HrHQ7F=(5l^9#!NcO"Tivoli

Decision Support N@0iUr(7^9#

18


18.T

ivoli

Decisio

nS

up

po

rt

Tivoli Decision Support for Enterprise Risk Management KD$FO"LNqAGb@7F$^

9#xQD=JqANU)<^CH*hSLVKD$FO"XTivoli Decision Support for

Enterprise Risk Management qAYr2H7F/@5$#VTivoli Decision Support for

Enterprise Risk Management jj<9&N<HWKO"J<NbF,-\5lF$^9#

¶ Tivoli Decision Support for Enterprise Risk Management N5W

¶ $s9H<kps ($s9H<kWo"$s9H<kjg"*hSF$s9H<kjgJ

I)

¶ TEC G<?Y<9XN"/;9}!d"l]<HN8.}!JIN`njg

¶ HiVk7e<F#s0ps*hSdjNsp}!

¶ T@J=UH&'"c2")B"*hSPh!Nb@

¶ G<?&=<9"Enterprise Risk Management "<+$V&F<Vk"*hS Tivoli

Decision Support =J$s?<U'<9N!=Nb@ (+F4j<"HTC/"*hSS

e<r^`)

Tivoli Decision Support for Enterprise Risk Management ��Risk Manager CD K^^lkVTivoli Decision Support for Enterprise Risk ManagementWG

O"Tivoli Decision Support for Enterprise Risk Management KD$Fb@7F$^9#

Tivoli Decision Support P<8gs 2.1.1 KX9k04JpsO"!NqAK"j^9#

¶ Tivoli Decision Support Installation Guide"GC32-0438

¶ Tivoli Decision Support Administrator Guide"GC32-0437

¶ Tivoli Decision Support User’s Guide"GC32-0436

^ 25. Tivoli Decision Support @0iUNc

222 P<8gs 3 jj<9 8

Tivoli Decison Support ��$s9H<k9k0K"VTivoli Risk Manager jj<9&N<HWr2H7F"=UH&'

"Wo*hS Risk Manager KX9kG7ps (Tivoli Decision Support for Enterprise Risk

Management r^`) r4YF/@5$#

Tivoli Decision Support for Enterprise Risk Management r$s9H<k9kKO"J<Nh&

K7^9#


2. Tivoli Decision Support $s9H<k&QC1<8r^`G#l/Hj<KQ97^9#

cd x:\tds_guide

x: O4HQN CD-ROM Ii$VG9#

3. Windows InstallShield Wm0i`r/09kKO"!NH*j~O7^9#

setup

4. InstallShield Wm0i`NX(K>CF"$s9H<kr0;7^9#

Tivoli Decision Support for Enterprise Risk Management ��!N}!KX9k=.jgKD$FO"VTivoli Decision Support for Enterprise Risk

ManagementWr2H7F/@5$#

¶ *<Ws&G<?Y<9&3M/F#SF#< (ODBC) G<?&=<9\3N;CH"C

W"*hS ODBC Ii$P<&$s9H<kN!:

¶ TEC $YsH&G<?Y<9K*1k"<+$V&F<Vk"Se<"*hSHj,<N

n.#\7/O"XRISK Manager TEC G<?Y<9K*1k"<+$V&F<Vk"S

e<"*hSHj,<Nn.Yr2H7F/@5$#

¶ &Q=<9&U!$k&Q9N=.

¶ Enterprise Risk Management ,$IN$s9H<k*hS$s]<H

¶ G<?&=<9NdjvF*hS!:

¶ TEC ?9/rHQ7?$YsH&"<+$VN918e<k#?9/KD$FO"109Z

<8NX$YsHr"<+$V9k?aN TEC ?9/Yr2H7F/@5$#

RISK Manager TEC ��7�;��;��-#��

"<+$V&F<Vk"Se<"*hSHj,<rn.9k0K"G<?Y<9,}C9kG

<?&\je<`KP7=,J5$:G"k3HrN'7^9#=NeG"!N SQL Wm7

<8c<rT$" Oracle"DB2"*hS Sybase G<?Y<9QN"<+$V&F<Vk"S

e<"*hSHj,<rn.7^9#

1. SQL Wm7<8c<&U!$kr+U1^9#3liNU!$kO"

TDS_Share¥Util¥Tivoli Decision Support for Enterprise Risk Management (TDS_Share

O"Tivoli G#l/Hj<I}Wm0i`GjA5l?&QG<?&U!$k&Q9r=

9) K"j^9#^?"3liNU!$kO"Risk Manager Unix 5<P<&79F`N


18.T

ivoli

Decisio

nS

up

po

rt

$BINDIR/RISKMGR/corr/sql G#l/Hj<"^?O Risk Manager Windows 5<P<&

79F`N %BINDIR%¥RISKMGR¥corr¥sql G#l/Hj<Kb"j^9#

2. TEC G<?Y<9,"k79F`eG"SQL Wm7<8c<&U!$krBT7^9#

m: ,WK~8F"Wm7<8c<&U!$kr TEC 79F`K3T<7F+iBT7

^9#

3. Oracle Nlg"!Nh&K~O7^9#

sqlplus userid/password @ service_name @ tds_rm_tec_t_arc.ora.sqlsqlplus userid/password @ service_name @ tds_rm_tec_v_evt.ora.sqlsqlplus userid/password @ service_name @ tds_rm_upd_trigger.ora.sql

F`\O"!NH*jG9#


password


service_name

Oracle /i$"sH=.Wm0i`GjA5l? Oracle G<?Y<9NMCH&

5<S9> (″Net8 Assistant″"″Net8 Configuration Assistant″"^?O ″Net8 Easy

Configuration″)""k$O/i$"sHN

%ORACLE_HOME%¥NETWORK¥ADMIN¥TNSNAMES.ORA U!$kNF`\r1L9k>0r

=7^9#

DB2 Nlg"!Nh&K~O7^9#

db2 connect to tec user userid using passworddb2 -t -f tds_rm_tec_t_arc.DB2.sqldb2 -t -f tds_rm_tec_v_evt.DB2.sqldb2 -t -f tds_rm_upd_trigger.DB2.sql

F`\O"!NH*jG9#

userid G<?Y<9&f<6< ID r=7^9# UNIX NlgNGU)kHMO"

db2inst1 G9# Windows NT NGU)kHMO" db2admin G9#

password

G<?Y<9Nf<6<&Q9o<Ir=7^9#

Sybase Nlg"!Nh&K~O7^9#

isql -Uuserid -Ppassword -Dtec -Sserver -c/ -i tds_rm_t_arc.syb.sqlisql -Uuserid -Ppassword -Dtec -Sserver -c/ -i tds_rm_v_evt.syb.sqlisql -Uuserid -Ppassword -Dtec -Sserver -c/ -i tds_rm_upd_trigger.syb.sql

F`\O"!NH*jG9#


password


server DSEDIT /i$"sH=.Wm0i`GjA5l? Sybase G<?Y<9N5<P

<>"^?O/i$"sHN Sybase $s?<U'<9&U!$k

%SYBASE%¥INI¥SQL.INI NF`\r1L9k>0r=7^9#

224 P<8gs 3 jj<9 8

m: G<?Y<9>"f<6< ID"*hSQ9o<IO"WiCHU)<`*hSD-K

G-NbNG9#\YKD$FO"79F`&"I_K9Hl<?<K*d$go;

/@5$#

Tivoli Decision Support for Enterprise Risk Management ��

J<N}!KD$FO"Decision Support for Enterprise Risk Management NqAr2H7F/

@5$#

¶ Enterprise Risk Management ,$INHQ

¶ l]<HN8.

¶ l]<H8.N918e<k

¶ HiVk7e<F#s0

¶ (i<h}


18.T

ivoli

Decisio

nS

up

po

rt

226 P<8gs 3 jj<9 8

Risk Manager �$+&�0

3NU?GO"Risk Manager G=(5lkaC;<8rj9H7^9#aC;<8KO"

HRMAAnnnnS H$&A0NVf,U1ilF$^9#

HRM Risk Manager NaC;<8G"k3Hr(7^9#

AA aC;<8r/T7? Risk Manager N3s]<MsHr(7^9#

CI Cisco Secure IDS

NI Network Intrusion Detection System (Network IDS)

nnnn CjNaC;<8Vfr(7^9#

S EgYlYkr(7^9#

Vf,U1ilF$J$aC;<8O"=lr/T7?3s]<MsH4HK"kU!YCH

gKBYF$^9#

Risk Manager ��$+&�0Vf,U1ilF$J$J<N Risk Manager jXaC;<8,=(5lklg,"j^9#

=.U!$k riskmgr_hosts.pro Nh}fK(i<#

EgY: MINOR

b@:¶ rm_ErrFile = ’riskmgr_hosts.pro’

¶ rm_ErrLine = ’unknown’

¶ rm_ErrMethod = set_host()

riskmgr_hosts.pro U!$kbN set_host Rt,5zG9#

79F`NhV: [9H&U!/HO Risk Manager NjXh}KOH_~^l^;s#

f<6<NhV: riskmgr_hosts.pro U!$kbN:v9F<HasHr$57F/@5$#!K"

rmcorr.cfg -reconfig 3^sIrBT7F"=N$5r^aF$YsH&5<P<rFO07F/@5

$#

=.U!$k riskmgr_host.pro Nh}fK(i<#

EgY: MINOR



A


A.

Risk

Man

ager�$+&

�0

¶ rm_ErrMethod = set_trusted_host( )

riskmgr_host.pro U!$kbN set_trusted_host Rt,5zG9#

79F`NhV: U!/HO Risk Manager NjXh}KOH_~^l^;s#

f<6<NhV: riskmgr_host.pro U!$kbN:v9F<HasHr$57F/@5$#!K"


$#


EgY: MINOR



¶ rm_ErrMethod = set_sensor( )

riskmgr_host.pro U!$kbN set_sensor Rt,5zG9#




$#


EgY: MINOR



¶ rm_ErrMethod = downgrade_sensor_creation( )

riskmgr_host.pro U!$kbN set_downgrade_sensor_creation Rt,5zG9#




$#

=.U!$k riskmgr_host.pro Nh}fK(i<#rm_ErrFile = ’riskmgr_hosts.pro’ rm_ErrLine = ’unknown’rm_ErrMethod = set_ignore_sensor_creation( )#

EgY: MINOR



¶ rm_ErrMethod = ignore_sensor_creation( )

riskmgr_host.pro U!$kbN set_ignore_sensor_creation Rt,5zG9#


228 P<8gs 3 jj<9 8



$#

=.U!$k riskmgr_parameters.pro Nh}fK(i<#

EgY: MINOR



¶ rm_ErrMethod = set_forward_tec( )

riskmgr_parameters.pro U!$kbN set_forward_tec Rt,5zG9#


f<6<NhV: riskmgr_parameters.pro U!$kbN:v9F<HasHr$57F/@5$#!

K"rmcorr.cfg -reconfig 3^sIrBT7F"=N$5r^aF$YsH&5<P<rFO07F/

@5$#

=.U!$k riskmgr_thresholds.pro Nh}fK(i<#

EgY: MINOR

b@:¶ rm_ErrFile = ’riskmgr_thresholds.pro’


¶ rm_ErrMethod = set_threshold( )

riskmgr_thresholds.pro U!$kbN set_threshold Rt,5zG9#

79F`NhV: U!/H_jO Risk Manager NjXh}KOH_~^l^;s#Risk Manager jX

O"%^7/J$FAru1klg,"j^9#

f<6<NhV: riskmgr_thresholds.pro U!$kbN:v9F<HasHr$57F/@5$#!


@5$#


EgY: MINOR

b@:¶ rm_ErrFile = ’riskmgr_parameters.pro’


¶ rm_ErrMethod = set_timestamp_jitter( )

riskmgr_parameters.pro U!$kbN set_timestamp_jitter Rt,5zG9#

79F`NhV: U!/HO Risk Manager NjXh}KOH_~^l^;s#GU)kH,HQ5l

^9#



@5$#


A.

Risk

Man

ager�$+&

�0


EgY: MINOR



¶ rm_ErrMethod = set_situation_expiration( )

riskmgr_parameters.pro U!$kbN set_situation_expiration Rt,5zG9#




@5$#


EgY: MINOR



¶ rm_ErrMethod = set_situation_cleanup_interval( )

riskmgr_parameters.pro U!$kbN set_situation_cleanup_interval Rt,5zG9#




@5$#


EgY: MINOR



¶ rm_ErrMethod = set_interface_refresh( )

riskmgr_parameters.pro U!$kbN set_interface_refresh Rt,5zG9#




@5$#

230 P<8gs 3 jj<9 8


EgY: MINOR



¶ rm_ErrMethod = set_forward_interval( )

riskmgr_parameters.pro U!$kbN set_forward_interval Rt,5zG9#




@5$#


EgY: MINOR



¶ rm_ErrMethod = set_decay_value( )

riskmgr_parameters.pro U!$kbN set_decay_value Rt,5zG9#




@5$#


EgY: MINOR



¶ rm_ErrMethod = set_ratio_down( )

riskmgr_parameters.pro U!$kbN set_ratio_down Rt,5zG9#




@5$#


A.

Risk

Man

ager�$+&

�0


EgY: MINOR



¶ rm_ErrMethod = set_ratio_up( )

riskmgr_parameters.pro U!$kbN set_ratio_up Rt,5zG9#




@5$#


EgY: MINOR



¶ rm_ErrMethod = set_storm_events( )

riskmgr_parameters.pro U!$kbN set_storm_events Rt,5zG9#




@5$#


EgY: MINOR



¶ rm_ErrMethod = set_linked_events( )

riskmgr_parameters.pro U!$kbN set_linked_events Rt,5zG9#




@5$#

232 P<8gs 3 jj<9 8


EgY: MINOR



¶ rm_ErrMethod = set_duplicate_events( )

riskmgr_parameters.pro U!$kbN set_duplicate_events Rt,5zG9#




@5$#


EgY: MINOR



¶ rm_ErrMethod = set_duplicate_events( )

riskmgr_parameters.pro U!$kbN set_duplicate_events Rt,5zG9#




@5$#

=.U!$k riskmgr_categories.pro Nh}fK(i<#

EgY: MINOR

b@:¶ rm_ErrFile = ’riskmgr_categories.pro’


¶ rm_ErrMethod = set_category_name( )

=.U!$kbN set_category_name Rt,5zG9#


f<6<NhV: =.U!$kbN:v9F<HasHr$57F/@5$#!K"rmcorr.cfg-reconfig 3^sIrBT7F"=N$5r^aF$YsH&5<P<rFO07F/@5$#


A.

Risk

Man

ager�$+&

�0


EgY: MINOR



¶ rm_ErrMethod = category_assign( )

=.U!$kbN category_assign Rt,5zG9#




EgY: MINOR



¶ rm_ErrMethod = category_assign_super( )

=.U!$kbN category_assign_super Rt,5zG9#




EgY: MINOR



¶ rm_ErrMethod = attribute_map ( )

=.U!$kbN attribute_map Rt,5zG9#



Prolog U!$k,m<I5l^;sG7?#*.wic U!$k,8_7F$k+N'7F/@5$#

EgY: FATAL

b@:¶ rm_ErrFile = ’boot.rls’

¶ rm_ErrLine = nnnn

¶ rm_ErrMethod = Rule start_RM_boot

Risk Manager k<k,5oKm<I5l^;sG7?#

79F`NhV: Risk Manager jX,:T7^7?#

234 P<8gs 3 jj<9 8

f<6<NhV: Risk Manager 5<P<,5oK$s9H<k5lF$k3HrN'7F/@5$#

/i9 class_name N?$`&9?sWH7FN date_reception K"=|7J$U)<kPC/,/87^7?#

EgY: FATAL

b@:¶ rm_ErrFile = ’normalization.rls’

¶ rm_ErrMethod = Rule process_timestamp

¶ Timestamp: value

¶ TimestampFmt value

¶ hostname = Sensor type type

¶ hostname = Sensor token: host_token

¶ IPaddr: ipaddr

hostname 0-G1L5lk";s5<+iN$YsH,"5zJ?$`&9?sWrw.7^7?#

79F`NhV: Risk Manager NjXQK"=_~o,$YsHKdjvFil^9#

f<6<NhV: "@W?<rA'C/7F/@5$#

/i9 class_name KD$FN;s5<ps,5zG9#

EgY: FATAL


¶ rm_ErrMethod = Rule process_sensor_info



¶ IPaddr: ipaddr

Risk Manager jX,h}G-J$;s5<G"$YsH,/87^7?#

79F`NhV: 3N(i<&aC;<8,8.5l^9#$YsHOjXh}KOH_~^l^;

s#

f<6<NhV: "@W?<rA'C/7F/@5$#

/i9 class_name N$YsHN/i9&+F4j<rh}G-^;sG7?#

EgY: FATAL


¶ rm_ErrMethod = Rule process_class_categories



¶ IPaddr: ipaddr

u.5l?$YsHr"Risk Manager jXNltH7Fh}9k3H,G-^;s#

79F`NhV: 3N(i<&aC;<8,8.5l^9#=N6xHJC?$YsHO"jXh}K

OH_~^l^;s#

f<6<NhV: Risk Manager N=.U!$krA'C/7F/@5$#


A.

Risk

Man

ager�$+&

�0

/i9 class_name N RM_SensorEvent Nh}fK(i<#

EgY: FATAL


¶ rm_ErrMethod = Rule process__ids_srcdst



¶ IPaddr: ipaddr

u.5l?$YsHKO"Risk Manager jXKH_~`@1N=,Jps,"j^;s#

79F`NhV: 3N(i<&aC;<8,8.5l^9#=N6xHJC?$YsHO"jXh}K

OH_~^l^;s#

f<6<NhV: Risk Manager N=.U!$krA'C/7F/@5$#

/i9 class_name N$C)N$YsHNh}fK(i<#

EgY: FATAL

b@:¶ rm_ErrFile = ’sensorevent.rls’

¶ rm_ErrMethod = Rule process__raw_events



$YsHr Risk Manager jXNltH7Fh}G-^;sG7?#

79F`NhV: =N6xHJC?$YsHO"jXh}KOH_~^l^;s#

f<6<NhV: 5]<HN?aNm<+kNjgK>CF/@5$#

r9$YsHNh}fK(i<#;s5<N?$W: host_name IPaddr#

EgY: FATAL

b@:¶ rm_ErrFile = ’sensorevent.rls’

¶ rm_ErrMethod = Rule process_external_situation



LN TEC ^?O Risk Manager 5<P<G/87?r9$YsHr5oKh}G-^;sG7?#

79F`NhV: r9psO"TEC ^?O Risk Manager 5<P<NjXKOH_~^l^;s#

f<6<NhV: 5]<HN?aNm<+kNjgK>CF/@5$#

236 P<8gs 3 jj<9 8

Network Intrusion Detection System �$+&�0Network IDS N`nfK"J<NaC;<8,/89k3H,"j^9#

HRMNI10002E [9HXN=1CHrn.G-^;sG7?: hostname#

b@: "i<HNm.s0N\*Gjb<H&[9HKP7F=1CHNN)rnT7F$kVK"(

i<,/87^7?#

f<6<NhV: P]N[9Hr ping 7F/@5$#

HRMNI10003E jb<H&[9HK\3G-^;sG7?#(i<&3<I: error number#

b@: "i<HNh}-?rHk\*Gjb<H&[9HXN\3rnT7F"(i<,/87^7

?#

f<6<NhV: [9HXNP)rA'C/7F/@5$#\3(i<&3<IN\YKD$FO"H

Q7F$k*Zl<F#s0&79F`NI-easF<7gsr2H7F/@5$#P]N[9Hr

ping 7F/@5$#

HRMNI10004E [9HXG<?rw.fK(i<: hostname#

b@: "i<HNm.s0N\*Gjb<H&[9HXNG<?Nw.rnT7F$kVK"(i<,

/87^7?#

f<6<NhV: [9HXNP)rA'C/7F/@5$#P]N[9Hr ping 7F/@5$#

HRMNI10006E U!$k - file name: T - line number: 70KAc< - signature text +O~o,"j^;s#

b@: NIDS N=.O0U!$k ids.cfg K+O~oNjA,"j^;s#

f<6<NhV: NIDS =JrF$s9H<k7Fdjr{57F/@5$#

79F`NhV: NIDS Oi|=G-^;sG7?#Wm0i`Od_7^7?#

HRMNI10007E U!$k - file name: T - line number: 70KAc< - signature text *;~o,"j^;s#



HRMNI10009E ;Ql<?<,Xj5lF$^;s#

b@: 79F`&;Ql<?<,_j5lF$J$+"!P5l^;sG7?#

f<6<NhV: 79F`NGU)kHN;Ql<?<r"3^sIT"^?O NIDS N=.O0U!

$k ids.cfg G_j7F/@5$#



A.

Risk

Man

ager�$+&

�0

HRMNI10011E (i<&U!$k,Xj5lF$^;s#

b@: NIDS "i<HNGU)kHNm0&U!$kH7FNU!$k,Xj5lF$^;sG7?#

f<6<NhV: 79F`NGU)kHNm0&U!$kr"3^sIT"^?O NIDS N=.O0U

!$k ids.cfg G_j7F/@5$#


HRMNI10012E -zJ[9H&"Il9 address GO"j^;s#

b@: mC?[9H&"Il9N_jM,!P5l^7?#

f<6<NhV: NIDS N=.O0U!$k ids.cfg bN[9H&"Il9N_jMr!:7F/@5

$#


HRMNI10013E "Il9,Xj5lF$^;s#

b@: [9H&"Il9NXj,!P5l^;sG7?#

f<6<NhV: NIDS N=.O0U!$k ids.cfg bN[9H&"Il9N_jMr!:7F/@5

$#


HRMNI10014E -zJMCHo</&"Il9 address GO"j^;s#

b@: MCHo</&"Il9NXj,!P5l^;sG7?#

f<6<NhV: NIDS N=.O0U!$k ids.cfg bNMCHo</&"Il9N_jMr!:7F

/@5$#


HRMNI10016E -zJ^9/ address mask GO"j^;s#

b@: mC?MCHo</&^9/N_jM,!P5l^7?#

f<6<NhV: NIDS N=.O0U!$k ids.cfg bNMCHo</&^9/N_jMr!:7F/

@5$#


HRMNI10017E ^9/,Xj5lF$^;s#

b@: MCHo</&^9/NXj,!P5l^;sG7?#

f<6<NhV: NIDS N=.O0U!$k ids.cfg bNMCHo</&^9/N_jMr!:7F/

@5$#


238 P<8gs 3 jj<9 8

HRMNI10018E maxbyte_entropy M,Xj5lF$^;s#

b@: NOCRYPT 70KAc<&G#l/F#VKP7F maxbyte_entropy M,!P5l^;sG7

?#

f<6<NhV: NIDS N=.O0U!$k ids.cfg bN MAXBYTE_ENTROPY N_jMr!:7F

/@5$#


HRMNI10019E minbyte_entropy M,Xj5lF$^;s#

b@: CRYPT 70KAc<&G#l/F#VKP7F minbyte_entropy M,!P5l^;sG7?#

f<6<NhV: NIDS N=.O0U!$k ids.cfg bN MINBYTE_ENTROPY N_jMr!:7F

/@5$#


HRMNI10020E maxbit_entropy M,Xj5lF$^;s#

b@: NOCRYPT 70KAc<&G#l/F#VKP7F maxbit_entropy M,!P5l^;sG7?#

f<6<NhV: NIDS N=.O0U!$k ids.cfg bN MAXBIT_ENTROPY N_jMr!:7F/

@5$#


HRMNI10021E minbit_entropy M,Xj5lF$^;s#

b@: CRYPT 70KAc<&G#l/F#VKP7F minbit_entropy M,!P5l^;sG7?#

f<6<NhV: NIDS N=.O0U!$k ids.cfg bN MINBIT_ENTROPY N_jMr!:7F/

@5$#


HRMNI10023E abj<dj6j(i<,/3j^7?#

b@: =.Nm<Ih}fK"abj<dj6j(i<,/87^7?#


HRMNI10024E U!$k - file name: T - line number: 70KAc< - signature text MU#<kI,,WG9#

b@: ids.msg U!$kNm<IfN=8rO(i<G9#




A.

Risk

Man

ager�$+&

�0

HRMNI10025E U!$k - file name: T - line number: 70KAc< - signature text MSG U#<kI,,WG9#

b@: =.U!$kNi|=fN=8rO(i<G9#



HRMNI10026E U!$k - file name: T - line number: 70KAc< - signature text MSG ,,WG9#

b@: =.U!$kNi|=fN=8rO(i<G9#



HRMNI10030E U!$k - file name: T - line number: 70KAc< - signature text MAXPACKET M,,WG9#

b@: ;C7gs&70KAc<Nm<IfK(i<,/87^7?#

f<6<NhV: ids.rules bN;C7gs&70KAc<N=8r!:7F/@5$#


HRMNI10031E U!$k - file name: T - line number: 70KAc< - signature text RPC 5<S9,,WG9#

b@: RPC 70KAc<Nm<IfK(i<,/87^7?#

f<6<NhV: ids.rules bN RPC 70KAc<N=8r!:7F/@5$#


HRMNI10032E U!$k - file name: T - line number: 70KAc< - signature text T@N RPC 5<S9: 5<S9

ID#

b@: RPC 70KAc<Nm<IfK(i<,/87^7?#

f<6<NhV: ids.rules bN RPC 70KAc<N=8r!:7F/@5$#


HRMNI10034E U!$k - file name: T - line number: 70KAc< - signature text SECURITY M,,WG9#

b@: IP 70KAc<Nm<IfK(i<,/87^7?#

f<6<NhV: ids.rules bN IP 70KAc<N=8r!:7F/@5$#


HRMNI10035E U!$k - file name: T - line number: 70KAc< - signature text T@N IP *W7gs: IP

option#




240 P<8gs 3 jj<9 8

HRMNI10037E U!$k - file name: T - line number: 70KAc< - signature text MIN/MAX M,,WG9#




HRMNI10039E U!$k - file name: T - line number: 70KAc< - signature text T@N FRAG *W7gs:fragmenation option#




HRMNI10042E U!$k - file name: T - line number: 70KAc< - signature text FAIL M,,WG9#




HRMNI10044E U!$k - file name: T - line number: 70KAc< - signature text T@N TCP *W7gs: TCP

option#

b@: TCP 70KAc<Nm<IfK(i<,/87^7?#

f<6<NhV: ids.rules bN TCP 70KAc<N=8r!:7F/@5$#


HRMNI10046E U!$k - file name: T - line number: 70KAc< - signature text H</s,,WG9#

b@: ICMP 70KAc<Nm<IfK(i<,/87^7?#

f<6<NhV: ids.rules bN ICMP 70KAc<N=8r!:7F/@5$#


HRMNI10047E U!$k - file name: T - line number: 70KAc< - signature text =sQ_H</s: H</sO

number hjbg-/J1lPJj^;s: ,\: number#

b@: 70KAc<N=8rOfK"-zJH</s,!P5l^;sG7?#

f<6<NhV: ids.rules bN ICMP 70KAc<N=8r!:7F/@5$#



A.

Risk

Man

ager�$+&

�0

HRMNI10050E U!$k - file name: T - line number: 70KAc< - signature text TIJ AUTH l3<I#

b@: 'ZKX"9k"/;9)fj9H (ACL) Nh}fK"(i<,/87^7?#

f<6<NhV: ids.rules bN'ZX"N ACL N=8r!:7F/@5$#


HRMNI10052E U!$k - file name: T - line number: 70KAc< - signature text SRCDST U#<kI,,WG

9#

b@: ;C7gs&70KAc<Nh}fK(i<,/87^7?#



HRMNI10053E U!$k - file name: T - line number: 70KAc< - signature text USER/PASSWD/AUTHFAIL H</s,,WG9#

b@: ;C7gs&70KAc<Nh}fK(i<,/87^7?#



HRMNI10055E U!$k - file name: T - line number: 70KAc< - signature text H</s,,WG9#

b@: 70KAc<Nh}fK"lL(i<,/87^7?#

f<6<NhV: ids.rules bN70KAc<N=8r!:7F/@5$#


HRMNI10056E U!$k - file name: T - line number: 70KAc< - signature text abj<T-#

b@: RPC 5<S9&70KAc<Nh}fK(i<,/87^7?#

f<6<NhV: ids.rules bN RPC 5<S9&70KAc<NHQ!r!:7F/@5$#


HRMNI10059E U!$k - file name: T - line number: 70KAc< - signature text PROC Vf,,WG9#

b@: RPC 5<S9&70KAc<Nh}fK(i<,/87^7?#



242 P<8gs 3 jj<9 8

HRMNI10061E U!$k - file name: T - line number: 70KAc< - signature text H</s QNabj<rdj6

jfK(i<#

b@: RPC 5<S9&70KAc<Nh}fK(i<,/87^7?#



HRMNI10062E U!$k - file name: T - line number: 70KAc< - signature text ^&sH&70KAc<,,WG

9#

b@: RPC 5<S9&70KAc<Nh}fK(i<,/87^7?#



HRMNI10065E U!$k - file name: T - line number: 70KAc< - signature text HOST ^?O DIR H</s,,

WG9#

b@: RPC 5<S9&70KAc<Nh}fK(i<,/87^7?#



HRMNI10066E U!$k - file name: T - line number: 70KAc< - signature text FILE H</s,,WG9#

b@: RPC 5<S9&70KAc<Nh}fK(i<,/87^7?#



HRMNI10067E U!$k - file name: T - line number: 70KAc< - signature text FILE ,,WG9#

b@: RPC 5<S9&70KAc<Nh}fK(i<,/87^7?#



HRMNI10068E U!$k - file name: T - line number: 70KAc< - signature text UID M,,WG9#

b@: RPC 5<S9&70KAc<Nh}fK(i<,/87^7?#




A.

Risk

Man

ager�$+&

�0

HRMNI10069E U!$k - file name: T - line number: 70KAc< - signature text GID M,,WG9#

b@: RPC 5<S9&70KAc<Nh}fK(i<,/87^7?#



HRMNI10070E U!$k - file name: T - line number: 70KAc< - signature text MODE M,,WG9#

b@: RPC 5<S9&70KAc<Nh}fK(i<,/87^7?#



HRMNI10071E U!$k - file name: T - line number: 70KAc< - signature text sigfname ,,WG9#

b@: RPC 5<S9&70KAc<Nh}fK(i<,/87^7?#



HRMNI10075E U!$k - file name: T - line number: 70KAc< - signature text MH</s,,WG9#

b@: RPC 5<S9&70KAc<Nh}fK(i<,/87^7?#



HRMNI10076E U!$k - file name: T - line number: 70KAc< - signature text NFS >,,WG9#

b@: RPC 5<S9&70KAc<Nh}fK(i<,/87^7?#



HRMNI10077E U!$k - file name: T - line number: 70KAc< - signature text NFS U#<kI,,WG9#

b@: RPC 5<S9&70KAc<Nh}fK(i<,/87^7?#



HRMNI10079E U!$k - file name: T - line number: 70KAc< - signature text ALLOW/NOTIFY H</s,,

WG9#

b@: 5]<H5lF$k70KAc< ACL Nh}fK(i<,/87^7?#

f<6<NhV: 5]<H5lF$k ACL NHQ!r!:7F/@5$#


244 P<8gs 3 jj<9 8

HRMNI10080E U!$k - file name: T - line number: 70KAc< - signature text SRC/SRCDST H</s,,WG

9#




HRMNI10081E U!$k - file name: T - line number: 70KAc< - signature text TIME ^?O HOST/NET U#<

kI,,WG9#




HRMNI10082E U!$k - file name: T - line number: 70KAc< - signature text TIME ^?O HOST U#<kI

,,WG9#




HRMNI10083E U!$k - file name: T - line number: 70KAc< - signature text "Il9,,WG9#




HRMNI10084E IP "Il9 ,$jAG9 - ids.cfg r4YF/@5$#




HRMNI10085E U!$k - file name: T - line number: 70KAc< - signature text 57/J$[9H&"Il9 IP

address#





A.

Risk

Man

ager�$+&

�0

HRMNI10086E U!$k - file name: T - line number: 70KAc< - signature text MCHo</&"Il9,,WG

9#




HRMNI10087E IP "Il9 ,jA5lF$^;s - ids.cfg r4YF/@5$#




HRMNI10088E U!$k - file name: T - line number: 70KAc< - signature text 57/J$MCHo</&"Il

9 Network address#




HRMNI10089E U!$k - file name: T - line number: 70KAc< - signature text ^9/,,WG9#




HRMNI10090E U!$k - file name: T - line number: 70KAc< - signature text 57/J$MCHo</&^9/

network mask#




HRMNI10091E U!$k - file name: T - line number: 70KAc< - signature text

HOST/NET/PEAK/OFFPEAK/ANY/NEVER H</s,,WG9#




246 P<8gs 3 jj<9 8

HRMNI10092E U!$k - file name: T - line number: 70KAc< - signature text TOKEN U#<kI,,WG9#




HRMNI10093E U!$k - file name: T - line number: 70KAc< - signature text =sQ_H</s: H</sO

> number GJ1lPJj^;s#




HRMNI10095E U!$k - file name: T - line number: 70KAc< - signature text M,,WG9#

b@: EVENT ^?O LOG N=.G<?Nh}fK(i<,/87^7?#

f<6<NhV: EVENT *hS LOG h}G#l/F#VN=8r!:7F/@5$#


HRMNI10096E U!$k - file name: T - line number: 70KAc< - signature text VALUE|TOKEN H</s,,W

G9#




HRMNI10097E U!$k - file name: T - line number: 70KAc< - signature text ASCII ^?O TCPDUMP H<

/s,,WG9#




HRMNI10098E U!$k - file name: T - line number: 70KAc< - signature text RAW|SESSION|TCPDUMP H<

/s,,WG9#





A.

Risk

Man

ager�$+&

�0

HRMNI10099E U!$k - file name: T - line number: 70KAc< - signature text FILECHOST H</s,,WG

9#




HRMNI10100E [9H&"Il9,,WG9#




HRMNI10101E ]<HVf,,WG9#




HRMNI10106E CONSOLE|SYSLOG|PATH|HOST ,,WG9#




HRMNI10109E T@NG<?&js/&?$W hex device type"decimal device type r!P7^7?#

b@: 79F`,T@NuV?$Wr!P7^7?#


HRMNI10110E 79F`, FDDI QK=.5lF$^;s#

b@: 4HQN=UH&'"NP<8gsO"FDDI "@W?<r5]<H7F$^;s#


HRMNI10111E getIPFrag Gbt(i<#

b@: IP Ui0asHNh}fK(i<,/87^7?#

79F`NhV: NIDS ,d_7"FO07^9#

248 P<8gs 3 jj<9 8

HRMNI10112E Total packets: packets Dru. packets Dr|n: dg: =_: ratio gW: overall ratio: C: interval in

seconds (: dropped per second#

b@: Q1CHN9k<WCH}Wrsp7^9#

HRMNI10114E 79F`, PPP QK=.5lF$^;s#

b@: 4HQN=UH&'"NP<8gsO"PPP r5]<H7F$^;s#


HRMNI10115E 79F`, RAW IP QK=.5lF$^;s#

b@: 4HQN=UH&'"NP<8gsO"RAW IP h}r5]<H7F$^;s#


HRMNI10116E 79F`, SLIP QK=.5lF$^;s#

b@: 4HQN=UH&'"NP<8gsO"SLIP r5]<H7F$^;s#


HRMNI10157E *W7gs -option name O5]<H5l^;s#

b@: mC?3^sIT*W7gs,!P5l^7?#

f<6<NhV: =JNI-easF<7gsG57$HQ!r4Yk+"’-h’ *W7gsrXj7F

/@5$#


HRMNI10158E PID U!$kKq-~a^;s: file name#

b@: NIDS O Wm;9 ID U!$krn.9k3H,G-^;s#

f<6<NhV: $s9H<k&G#l/Hj<NU!$kvDr!:7F/@5$#


HRMNI10159E =.U!$krm<IfK(i<: file name#

b@: O0=.U!$kNm<IfK(i<,/87^7?#

f<6<NhV: U!$kvDr!:9k+"NIDS =JrF$s9H<k7F"djr$57F/@

5$#



A.

Risk

Man

ager�$+&

�0

HRMNI10160E 70KAc<&U!$krm<IfK(i<: file name#

b@: 70KAc<&U!$kNm<IfK(i<,/87^7?#


5$#


HRMNI10161E aC;<8&U!$krm<IfK(i<: file name#

b@: aC;<8&U!$kNm<IfK(i<,/87^7?#


5$#


HRMNI10163E Wm;9 - root H7FBT9k,W,"j^9#

b@: NIDS h}N+OrnT7^7?,"=,J"B,"j^;s#

f<6<NhV: root H7Fm0*s7"NIDS Wm;9rFO07F/@5$#


HRMNI10166E PID U!$kr*<WsG-^;s: file name#

b@: NIDS r kill 7h&H7^7?,"Wm;9 ID r=LG-^;sG7?#

HRMNI10167E PID U!$krI_hl^;s: file name#

b@: NIDS r kill 7h&H7^7?,"Wm;9 ID r=LG-^;sG7?#

HRMNI10171E :T7^7?: -zJ70JkGO"j^;s#

b@: mC?70JkG NIDS r kill 7h&H7^7?#

HRMNI10172E :T7^7?: PID ,+U+j^;sG7?#

b@: mC? PID G NIDS r kill 7h&H7^7?#

HRMNI10173E :T7^7?: "/;9"NdjG9#’root’ H7Fdj>7F/@5$#

b@: T=,J"/;9"G NIDS r kill 7h&H7^7?#

HRMNI10174E :T7^7?: T@Nc2G9#

b@: NID r kill 7h&H7F(i<,/87^7?#}33<Ir=L9k3H,G-^;s#

f<6<NhV: dj>7F/@5$#

250 P<8gs 3 jj<9 8

HRMNI10175E !N NIDS PID ,5zG9: number#

b@: mC? PID G NIDS r kill 7h&H7^7?#

HRMNI10176E !NU!$kr*<WsfK(i<,/87^7?: file name#

b@: 5V8'/H&U!$kr*<Ws7h&H7F(i<,/87^7?#

f<6<NhV: "/;9vDr!:7"dj>7F/@5$#


HRMNI10177E !NU!$krI_hjfK(i<,/87^7?: file name#

b@: P]NU!$krI_hjfK(i<,/87^7?#

f<6<NhV: "/;9vDr!:7"dj>7F/@5$#


HRMNI10179E U!$k - file name: T - line number: 70KAc< - signature text SRCDST U#<kI,,WG

9#

b@: ACL r=8rOfK(i<,/87^7?#

f<6<NhV: SRC *hS DST U#<kINHQ!rN'7F/@5$#


HRMNI10180E U!$k - file name: T - line number: 70KAc< - signature text SERVICE U#<kI,,WG

9#

b@: SMB 70KAc<Nh}fK(i<,/87^7?#

f<6<NhV: SERVICE G#l/F#VNHQ!,,ZG"k3HrN'7F/@5$#


HRMNI10181E U!$k - file name: T - line number: 70KAc< - signature text ACL H</s,,WG9#




HRMNI10182E Xj7?"@W?<OxQT=G9#

b@: 3^sITGXj5l?"@W?<,HQT=G9#

f<6<NhV: ifconfig -a rHQ7F"HQD=J"@W?<rN'7F/@5$#



A.

Risk

Man

ager�$+&

�0

HRMNI10184E $s9H<ke"/F#SF#<G /etc/inittab N97K:T#

b@: +0Fn.!=rs!9k?aK /etc/inittab U!$kr977h&H7^7?,:T7^7?#

f<6<NhV: NIDS N$s9H<kK root ,HQ5lF$k3HrN'7F/@5

$#/etc/inittab KP9k"/;9vDr!:7F/@5$#


HRMNI10185E "s$s9H<ke"/F#SF#<G /etc/inittab N97K:T#

b@: $s9H<k&Wm7<8c<fKIC5l?`\r|n9k?aK /etc/inittab U!$kr97

7h&H7^7?,:T7^7?#

f<6<NhV: NIDS N"s$s9H<kK root ,HQ5lF$k3HrN'7F/@5

$#/etc/inittab KP9k"/;9vDr!:7F/@5$#


HRMNI10186E F"*H_~_U!$k : U!$k %1$s#

b@: ids.rules KH_~^l?U!$kN<5r6(F$^9#

f<6<NhV: 70KAc<&k<krFT.7F"F"*H_~_r|n7F/@5$#


HRMNI10187E T,ZJ0G9: %1$s#

b@: 5,==NQ<5<,"0r>A9k3H,G-^;sG7?#

f<6<NhV: ids.rules U!$kbN9YFN REGEX `\r!:7F/@5$#


HRMNI10188E Q?<srh}fK(i<#

b@: ids.rules G!P5l?5,==rh}fK"NIDS ,(i<r!P7^7?#

f<6<NhV: ids.rules U!$kbN9YFN REGEX `\r!:7F/@5$#


HRMNI10189E %1$d P$HNabj<rdj6l^;s#

b@: IP Ui0asHNh}fK"abj<dj6j(i<,/87^7?#

79F`NhV: NIDS ,d_7"FO07^9#

252 P<8gs 3 jj<9 8

��$+&�0

HRMIN0011E 3N3^sIrBT9kKO"Tivoli D-G,ZJI}P]N<IN"I_K9Hl<?<QNm0$

sr_j7J1lPJj^;s#

b@: 3N(i<,/89kNO"Tivoli D-r_j7F$J+C?lg"^?O"s$s9H<kN

BT"Br}CF$J$lgK"I}P]N<I+i Risk Manager 5<P< (RISKMGR_CORR) ^?

O Risk Manager Perl 5]<H (RISKMGR_PERL) r"s$s9H<k7h&H7?H-G9#

79F`NhV: h}Od_7^9#

f<6<NhV: setup_env.sh 9/jWHrHQ7F"Tivoli D-r=.7F/@5$#,:""s$

s9H<kN?aN Tivoli "I_K9Hl<?<"Br}Dm0$s<GBT7F/@5$#

HRMIN0012E =.U!$k filename rQia<?< parameter_name NMG979k3H,G-^;s#

b@: (5l?Qia<?<NMG"=.U!$kr979k3H,G-^;sG7?#3NdjNG

bD=-Nb$6xH7FO"U!$kr979k?aK=,J9Z<9,U!$k&79F`KJ

$"^?OU!$kvDKdj,"k3H,M(il^9#

79F`NhV: h}Od_7^9#

f<6<NhV: djr9YF{57"3^sIrBT7>7F/@5$#

HRMIN0013E !NU!$krn.G-^;s: file_name

b@: $s9H<kfKn.5lk=.U!$krn.G-^;sG7?#3NdjNGbD=-Nb

$6xH7FO"U!$krn.9k?aK=,J9Z<9,U!$k&79F`KJ$"^?OU!

$kvDKdj,"k3H,M(il^9#

79F`NhV: h}Od_7^9#

f<6<NhV: U!$k&79F`X"Ndjr9YF{57"$s9H<krdj>7F/@5

$#

HRMIN0014E !NG<bsr+O9k?aN /etc/inittab KP7F`\rICG-^;s: executable_name

b@: BTD=r+O9k?aN`\r inittab K^~9k3H,G-^;sG7?#

79F`NhV: h}Od_7^9#

f<6<NhV: djr9YF{57"$s9H<k7>7F/@5$#

HRMIN0016E !NG<bsrd_G-^;s: executable_name

b@: G<bsOd_7^;sG7?#

f<6<NhV: G<bs,^@BT7F$klgKO"kill 3^sIrBT7F"Wm;9rd_7

F/@5$#


A.

Risk

Man

ager�$+&

�0

HRMIN0017E =.U!$krPC/"CWG-^;s: filename

b@: F$s9H<kfK"(5l?=.U!$kNf<6<N=T3T<r]IG-^;sG7?#

3NdjNGbD=-Nb$6xH7FO"U!$krn.9k?aK=,J9Z<9,U!$k&7

9F`KJ$"^?OU!$kvDKdj,"k3H,M(il^9#

79F`NhV: h}Od_7^9#

f<6<NhV: djr{57"$s9H<k7>7F/@5$#

HRMIN0018E =.U!$k filename rU!$kN]IQ_P<8gsGV-9(G-^;s#

b@: Risk Manager Event Integration Facility NF$s9H<k~NGeK"rmad.conf *hS

rmad_summary.rules =.U!$kN]IQ_P<8gsr RISKMGR/etc G#l/Hj<K3T<7h&

H7^7?#3lOBTG-^;sG7?#

79F`NhV: $s9H<kO0;7^9#

f<6<NhV: RISKMGR/etc G#l/Hj<bNXj5l?U!$kH"RISKMGR/etc/backup G#l

/Hj<bNU!$kN3T<r=(7F/@5$#U!$k,[JCF$?j"PC/"CW&G#

l/Hj<bNU!$krHQ9klgKO"HQ9kU!$kr (,WK~8F>0rQ97F)

RISKMGR/etc G#l/Hj<K3T<7F/@5$#

HRMIN0019E 7s\jC/&js/ filename r RMEIF G<bsN TME P<8gsKn.G-^;s#

b@: Wm0i`O"RISKMGR/bin/tme bNU!$krX97s\jC/&js/r RISKMGR/bin Kn

.9k3H,G-^;sG7?#

79F`NhV: $s9H<kO0;7^9#

f<6<NhV: {NNdjr9YF{57"!K rmeif_cfg 3^sIrBT7F TME ^?O TME

J0N RMEIF =.r_j7^9#

HRMIN0020E 7s\jC/&js/ filename r RMEIF G<bsNs TME P<8gsKn.G-^;s#

b@: Wm0i`O"RISKMGR/bin/nontme bNU!$krX9"7s\jC/&js/r RISKMGR/bin

Kn.9k3H,G-^;sG7?#

79F`NhV: $s9H<kO0;7^9#

f<6<NhV: {NNdjr9YF{57"!K rmeif_cfg 3^sIrBT7F TME ^?O TME

J0N RMEIF =.r_j7^9#

Check Point FireWall-1 �$+&�0

HRMCP0001E Risk Manager Event Integration Facility ,$YsHrh}G-^;sG7?#

b@: Risk Manager Event Integration Facility O=.5lF$J$D=-,"j^9#

f<6<NhV: Risk Manager Event Integration Facility rF=.7F/@5$#

254 P<8gs 3 jj<9 8

HRMCP0002E Risk Manager Event Integration Facility i$Vij<rm<IG-^;sG7?#

b@: Risk Manager Event Integration Facility N&Qi$Vij<,+U+j^;sG7?#

f<6<NhV: Risk Manager Event Integration Facility rF$s9H<k7F/@5$#

HRMCP0003E message#

b@: OPSEC G-N(i<&aC;<8G9#

HRMCP0004E message1: message2#

b@: OPSEC G-N(i<&aC;<8G9#

HRMCP0005E NT $YsH&m0r*<WsG-^;sG7?#

b@: T@G+D=|7J$"@W?<&(i<G9#

f<6<NhV: "@W?<rF$s9H<k7"F=.7F/@5$#

HRMCP0006E Windows NT l89Hj<bN variable name r_jf#

b@: "@W?<O"Windows l89Hj<K7,N`\rn.G-^;sG7?#

f<6<NhV: "@W?<,"I_K9Hl<?<"Br}CF$k3HrN'7F/@5$#

HRMCP0007E message1 3<I: message2

b@: T@G+D=|7J$"@W?<&(i<G9#

f<6<NhV: "@W?<rF$s9H<k7"F=.7F/@5$#

HRMCP0009E adapter name XNQ9r57^7?,+U+j^;sG7?#

b@: "@W?<O+,+HNLVr+U1k3H,G-^;sG7?#

f<6<NhV: "@W?<rF$s9H<k7F/@5$#

HRMCP0010E 5<S9r$s9H<kG-^;sG7?: adapter name#

b@: "@W?<,"+,+Hr Windows 5<S9H7F$s9H<k9k3H,G-^;sG7

?#

f<6<NhV: rma_cpfw -r rBT7F"=lr5<S9H7F|n7F/@5$#

HRMCP0014E 5<S9r|nG-^;s: adapter name#

b@: "@W?<,"+,+Hr Windows 5<S9H7F|n9k3H,G-^;sG7?#"@W

?<O=_ Windows 5<S9H7F$s9H<k5lF$J$D=-,"j^9#

f<6<NhV: "@W?<, Windows 5<S9N3sHm<k&QMkKj9H5lF$k+N'

7F/@5$#


A.

Risk

Man

ager�$+&

�0

HRMCP0026E --debug ^?O -d *W7gs, 2 sJeXj5l^7?#

b@: --debug ^?O -d *W7gs, 2 sJeXj5l^7?#

f<6<NhV: *W7gsN 2 V\N$s9?s9r|n7F/@5$#

HRMCP0027E --event-output ^?O -e *W7gs, 2 sJeXj5l^7?#

b@: --event-output ^?O -e *W7gs, 2 sJeXj5l^7?#


HRMCP0028E --warning-output ^?O -w *W7gs, 2 sJeXj5l^7?#

b@: --warning-output ^?O -w *W7gs, 2 sJeXj5l^7?#


HRMCP0029E --install-service ^?O -i *W7gs, 2 sJeXj5l^7?#

b@: --install-service ^?O -i *W7gs, 2 sJeXj5l^7?#


HRMCP0030E --remove-service ^?O -r *W7gs, 2 sJeXj5l^7?#

b@: --remove-service ^?O -r *W7gs, 2 sJeXj5l^7?#


HRMCP0031E *W7gsT@: option letter

b@: T@N3^sIT*W7gs,Xj5l^7?#

f<6<NhV: rma_cpfw --help ^?O -h rBT7F"3^sITN*W7gsr=(7F/@5

$#

HRMCP0034E OPSEC 5<P<HNL.,:ol^7?#\3rFnTf...

b@: OPSEC 5<P<HNL.,:ol?+"N)5lF$^;s#

f<6<NhV: OPSEC 5<P<,BT7F*j"MCHo</\3,0n7F$k3HrN'7F

/@5$#

HRMCP0035E Risk Manager Event Integration Facility 7s\krrhG-^;sG7?#



256 P<8gs 3 jj<9 8

Check Point FireWall-1 ��$+&�0

HRMSM0001E SAM ;C7gs,:T7^7?#m<+k SAM 5<P<K\3G-^;s#

b@: CheckPoint FireWall-1 N SAM $s?<U'<9rHQ9k?9/,"SAM 5<P<HNL.

rN)G-^;sG7?#

f<6<NhV: ?9/rdj>7F/@5$#:T,+jV7/89klgO"SAM 5<P<N=

.r!:7F/@5$#

79F`NhV: ?9/OWa5l?3^sIrBTG-^;s#

HRMSM0004E SAM /i$"sH&Wm;9,:T7^7?#

b@: CheckPoint FireWall-1 N SAM $s?<U'<9rHQ9k?9/,:T7^7?#

f<6<NhV: ?9/rdj>7F/@5$#:T,+jV7/89klgO"SAM 5<P<N=

.r!:7F/@5$#


HRMSM0006E parameter rrhG-^;s#

b@: CheckPoint FireWall-1 N SAM $s?<U'<9rHQ9k?9/,BTK:T7^7?#


f<6<NhV: ?9/rdj>7F/@5$#CheckPoint FireWall-1 SAM 5<P<r!:7F/@

5$#

HRMSM0007E OPSEC (i<O error code G9#

b@: OPSEC (i<,/87??aK"CheckPoint FireWall-1 N SAM $s?<U'<9rHQ9k

?9/,"BTK:T7^7?#



5$# CheckPoint FireWall-1 OPSEC NI-easF<7gsr4YF/@5$#

HRMSM0008E =|7J$ SAM u7G9#

b@: (i<,/87??aK"CheckPoint FireWall-1 N SAM $s?<U'<9rHQ9k?9/,

BTK:T7^7?#





A.

Risk

Man

ager�$+&

�0

HRMSM0009E OPSEC i|=,:T7^7?#


BTK:T7^7?#




HRMSM0010E /i$"sH&(sF#F#<Nn.,:T7^7?#


BTK:T7^7?#




HRMSM0011E 5<P<&(sF#F#<Nn.,:T7^7?#


BTK:T7^7?#




HRMSM0012E SAM ;C7gsNi|=,:T7^7?#


BTK:T7^7?#




HRMSM0013E Wa (SAM request) ,:T7^7?#


BTK:T7^7?#




258 P<8gs 3 jj<9 8

HRMSM0016E RMADHOME ,D-bK_j5lF$^;s#

b@: ,WJD-Qt,jA5lF$J$NG"?9/rBT9k3H,G-^;s#

79F`NhV: ?9/O:T7^9#

f<6<NhV: FAru1k^7seN Risk Manager $s9H<k&79F`r!:7F/@5

$#

HRMSM0017E rma_cpfw.conf K"/;9G-^;s#

b@: =.U!$kK"/;9G-J$NG"?9/rBT9k3H,G-^;s#

79F`NhV: ?9/O:T7^9#


$#

HRMSM0018E SAM 5<P<=.,0;7F$^;s#

b@: =.U!$kK"/;9G-J$NG"?9/rBT9k3H,G-^;s#

79F`NhV: ?9/O:T7^9#


$#

Cisco Secure IDS �$+&�0

HRMCI0001E Risk Manager Event Integration Facility ,$YsHrh}G-^;sG7?#

b@: Risk Manager Event Integration Facility O=.5lF$J$D=-,"j^9#

f<6<NhV: Risk Manager Event Integration Facility rF=.7F/@5$#

HRMCI0002E Risk Manager Event Integration Facility i$Vij<rm<IG-^;sG7?#



HRMCI0003E error number P??$`"&H#

b@: Cisco Datafeed 3s]<MsH,"f{N Cisco Secure IDS Communication Service +i~zr

u1hk3H,G-^;sG7?#

f<6<NhV: 3Njb<H&Wm;9HNL.Kdj,"klg,"j^9#


A.

Risk

Man

ager�$+&

�0

HRMCI0004E error number BT7F$^;s#

b@: Cisco IDS DataFeed 3s]<MsH,$s9H<k5lF$^;s#

f<6<NhV: Cisco DataFeed 3s]<MsHr$s9H<k7F/@5$#

HRMCI0005E error number i|=Q_G9#

b@: Cisco IDS DataFeed O9GKi|=5lF$^9#

f<6<NhV: "@W?<rFO07F/@5$#>KaC;<8,J$+"79F`&(i<&m

0r4YF/@5$#

HRMCI0006E error number i|=:T#

b@: "@W?<O Cisco IDS DataFeed 3s]<MsHNi|=K:T7F$^9#


0r4YF/@5$#

HRMCI0007E error number LN"Wj1<7gs,BTfG9#

b@: 2 f\N"@W?<^?O?+>N Cisco IDS DataFeed "Wj1<7gs,BTfG9#

f<6<NhV: rma_csids-init stop rBT7"b&l}N"@W?<rd_7F/@5$#dj,

+jV7/89klgO"csidsDataFeed stop -f rBT7" DataFeed/var G#l/Hj<+i9YFN

U!$kr|n7F/@5$#

HRMCI0008E error number T@#

b@: T@N(i<&3<IG9#

HRMCI0010E i|=K:T7^7?#

b@: "@W?<O Cisco DataFeed 3s]<MsHNi|=K:T7F$^9#


0r4YF/@5$#

HRMCI0021E --debug ^?O -d *W7gs, 2 sJeXj5l^7?#

b@: --debug ^?O -d *W7gs, 2 sJeXj5l^7?#


HRMCI0022E --event-output ^?O -e *W7gs, 2 sJeXj5l^7?#

b@: --event-output ^?O -e *W7gs, 2 sJeXj5l^7?#


260 P<8gs 3 jj<9 8

HRMCI0023E --warning-output ^?O -w *W7gs, 2 sJeXj5l^7?#

b@: --warning-output ^?O -w *W7gs, 2 sJeXj5l^7?#


HRMCI0024E *W7gsT@: option letter

b@: T@N3^sIT*W7gs,Xj5l^7?#

f<6<NhV: rma_csids --help ^?O -h rBT7F"3^sIT*W7gsNj9Hr=(7

F/@5$#

HRMCI0025E --install-service ^?O -i *W7gs, 2 sJeXj5l^7?#

b@: --install-service ^?O -i *W7gs, 2 sJeXj5l^7?#


HRMCI0026E --remove-service ^?O -r *W7gs, 2 sJeXj5l^7?#

b@: --remove-service ^?O -r *W7gs, 2 sJeXj5l^7?#


HRMCI0028E Windows NT l89Hj<bN variable name r_jf#

b@: "@W?<O"Windows l89Hj<K7,N`\rn.G-^;sG7?#

f<6<NhV: "@W?<,"I_K9Hl<?<"Br}CF$k3HrN'7F/@5$#

HRMCI0029E 5<S9r$s9H<kG-^;sG7?: adapter name

b@: "@W?<,"+,+Hr Windows 5<S9H7F$s9H<k9k3H,G-^;sG7

?#

f<6<NhV: rma_csids -r rBT7F"=lr5<S9H7F|n7F/@5$#

HRMCI0033E 5<S9r|nG-^;sG7?: adapter name

b@: "@W?<,"+,+Hr Windows 5<S9H7F|n9k3H,G-^;sG7?#"@W

?<O=_ Windows 5<S9H7F$s9H<k5lF$J$D=-,"j^9#

f<6<NhV: "@W?<, Windows 5<S9N3sHm<k&QMkKj9H5lF$k+N'

7F/@5$#

HRMCI0035E adapter name XNQ9r57^7?,+U+j^;sG7?#

b@: "@W?<O+,+HNLVr+U1k3H,G-^;sG7?#

f<6<NhV: "@W?<rF$s9H<k7F/@5$#


A.

Risk

Man

ager�$+&

�0

HRMCI0036E adapter name 3<I: error number

b@: T@G+D=|7J$"@W?<&(i<G9#

f<6<NhV: "@W?<rF$s9H<k7"F=.7F/@5$#

HRMCI0037E Risk Manager Event Integration Facility 7s\krrhG-^;sG7?#

b@: "@W?<, Risk Manager Event Integration Facility i$Vij<r+U1k3H,G-^;s

G7?#

f<6<NhV: Risk Manager Event Integration Facility r$s9H<k9k,W,"j^9#

262 P<8gs 3 jj<9 8

Risk Manager ��$+&�0

HRMCO0053E $s9H<kK:T7^7?#

b@: rmcorr_cfg 3^sI,(i<r!P7"0;7?h}r9YFPC/"&H7^7?#

79F`NhV: rmcorr_cfg 3^sIOd_7^9#

f<6<NhV: Qia<?<r!:7"rmcorr_cfg 3^sIrFBT7F/@5$#

HRMCO0056E !N7,k<k&Y<9NQ9rn.G-^;s: path

b@: rmcorr_cfg 3^sI,"Xj5l?G#l/Hj<Kk<k&Y<9rn.G-^;sG7

?#

79F`NhV: rmcorr_cfg 3^sIO"0;7?h}r9YFPC/"&H7^9#

f<6<NhV: -zJG#l/Hj<rXj7F rmcorr_cfg 3^sIrFBT7F/@5$#

HRMCO0057E k<k&Y<9 %1$s NQ9O9GKHQfG9#

b@: rmcorr_cfg 3^sI,"Xj5l?G#l/Hj<Kk<k&Y<9rn.G-^;sG7

?#


f<6<NhV: -zJG#l/Hj<rXj7F"rmcorr_cfg 3^sIrFBT7F/@5$#

HRMCO0059E k<k&Y<9 rulebase O3sQ$k5l^;s#

b@: k<k&Y<9O3sQ$k5l^;s#


f<6<NhV: k<k&Y<9,8_7F$klgO"=lr$57F+i Risk Manager Nk<k

r$s9H<k7F/@5$#k<k&Y<9,8_7F$J$lgO"Tivoli 5]<HK"m7F/

@5$#

HRMCO0060E k<k&Y<9 rulebase Nn.K:T7^7?#

b@: rmcorr_cfg 3^sI,"k<k&Y<9rn.9k3H,G-^;sG7?#


f<6<NhV: rmcorr_cfg KO5l?Qia<?<r!:7F/@5$#

HRMCO0061E k<k&Y<9 rulebase_from Nk<k&Y<9 rulebase_to XN3T<K:T7^7?#

b@: rmcorr_cfg 3^sIOk<k&Y<9r3T<9k3H,G-^;s#


f<6<NhV: rmcorr_cfg KO5l?Qia<?<r!:7F/@5$#rmcorr_cfg 3^sIrF

BT7F/@5$#


A.

Risk

Man

ager�$+&

�0

HRMCO0062E class Nk<k&Y<9 rulebase XN$s]<HK:T7^7?#

b@: 3N/i9O"k<k&Y<9K5oK$s]<H5l^;sG7?#


f<6<NhV: rmcorr_cfg KO5l?Qia<?<r!:7F/@5$# Tivoli D-,57/$s

9H<k5l"T/7F$k3HrN'7F/@5$# rmcorr_cfg 3^sIrFBT7F/@5$#

HRMCO0063E k<k&U!$k rules Nk<k&Y<9 rulebase XN$s]<HK:T7^7?#

b@: k<k&U!$kO"k<k&Y<9K5oK$s]<H5l^;sG7?#


f<6<NhV: rmcorr_cfg KO5l?Qia<?<r!:7F/@5$# Tivoli D-,57/$s

9H<k5l"T/7F$k3HrN'7F/@5$# rmcorr_cfg 3^sIrFBT7F/@5$#

HRMCO0064E G#l/Hj< directory N!wK:T7^7?#

b@: rmcorr_cfg 3^sIO"G#l/Hj<r57P93H,G-^;sG7?#

79F`NhV: rmcorr_cfg 3^sIO"0;7?h}r9YFPC/"&H7"d_7^9#

f<6<NhV: Risk Manager ,5oK$s9H<k5lF$k+!:7F/@5$#3^sIrFB

T7F/@5$#

HRMCO0067E k<k&Y<9 rulebase Nm<IK:T7^7?#

b@: rmcorr_cfg 3^sIOk<k&Y<9rm<I9k3H,G-^;sG7?#

79F`NhV: k<k&Y<9Om<I5lF$^;s#k<k&Y<9XNQ9OPC/"&H5

l^9#

f<6<NhV: rmcorr_cfg KO5l?Qia<?<r!:7F/@5$#=8(i<,J$+"

Risk Manager N=.U!$kr!:7F/@5$#c2N\Y,J$+"$BINDIR/RISKMGR/corr G#l

/Hj<bN ptc* (* Otz) r!:7F/@5$#3^sIrFBT7F/@5$#

HRMCO0068E TEC $YsH&5<P<N+OK:T7^7?#

b@: TEC $YsH&5<P<,+O7^;sG7?#

79F`NhV: TEC $YsH&5<P<O"/F#VGO"j^;s#

f<6<NhV: wstartesvr 3^sIrBT7F"TEC $YsH&5<P<r+O7F/@5$#

HRMCO0069E TEC $YsH&5<P<Nd_K:T7^7?#

b@: TEC $YsH&5<P<Od_7^;sG7?#

79F`NhV: rmcorr_cfg 3^sIO TEC $YsH&5<P<rFO07^;s#

f<6<NhV: TEC $YsH&5<P<rd_7F+iO07F/@5$#

264 P<8gs 3 jj<9 8

HRMCO0072E $YsH&=<9 eventsource Nn.K:T7^7?#

b@: rmcorr_cfg 3^sIO"$YsH&=<9rn.9k3H,G-^;sG7?#

79F`NhV: $YsH&=<9On.5l^;s#

f<6<NhV: ,WK~8F"3^sIrFBT7F/@5$#

HRMCO0073E ?9/&i$Vij< libraryname Nn.K:T7^7?#

b@: rmcorr_cfg 3^sIO"?9/&i$Vij<rn.9k3H,G-^;sG7?#

79F`NhV: ?9/&i$Vij<On.5l^;s#

f<6<NhV: Tivoli D-,$s9H<k5lF*j"5oKT/7F$k3HrN'7F/@5

$#79F`K c WjWm;C5< (cpp) ,$s9H<kQ_G"k3HrN'7F/@5$# Unix

79F`GO"rmcorr_cfg 3^sIO c WjWm;C5<H7F /usr/ccs/lib/cpp G#l/Hj<

rHQ7^9# Windows 79F`GO"c WjWm;C5< $BINDIR/tools/cpp.exe ,HQ5l^

9# ’rmcorr_cfg -tasklib’ rHQ7F?9/&i$Vij<rm<I9k3H,G-^9#

HRMCO0075E U!$kK filename "/;9G-^;s#

b@: rmcorr_cfg 3^sIO"(5l?U!$kK"/;99k3H,G-^;sG7?#


f<6<NhV: Tivoli Risk Manager 5<P<,,ZK$s9H<k5lF$k3HrN'7F/@5

$#

HRMCO0076E $YsH&-cC7e&5$:rh@G-^;s#

b@: rmcorr_cfg 3^sIO"$YsH&-cC7e&5$:rhj9k3H,G-^;sG7?#

79F`NhV: rmcorr_cfg 3^sIO3NaC;<8r=(7^9#

f<6<NhV: Tivoli D-,57/$s9H<k5l"T/7F$k3HrN'7F/@5$#

wlsesvrcfg 3^sIrHQ7F"$YsH&5<P<N=.rj9H9k3H,G-^9#

HRMCO0077E =Tk<k&Y<9>rh@G-^;s#

b@: rmcorr_cfg ,=TNk<k&Y<9&Q9r=L9k3H,G-^;sG7?#


f<6<NhV: Tivoli D-,57/$s9H<k5l"T/7F$k3HrN'7F/@5$# wrb-lscurrb 3^sIrHQ9kH"=TNk<k&Y<9rj9H9k3H,G-^9#

HRMCO0078E =Tk<k&Y<9&Q9r=LG-^;s#

b@: rmcorr_cfg ,=TNk<k&Y<9&Q9r=L9k3H,G-^;sG7?#


f<6<NhV: Tivoli D-,57/$s9H<k5l"T/7F$k3HrN'7F/@5$# wrb-lscurrb 3^sIrHQ9kH"=TNk<k&Y<9rj9H9k3H,G-^9#


A.

Risk

Man

ager�$+&

�0

HRMCO0079E class Nk<k&Y<9 rulebase +iNo|K:T7^7?#

b@: 3N/i9r"k<k&Y<9+io|9k3H,G-^;sG7?#

79F`NhV: rmcorr_cfg 3^sIO"k<k&Y<9+ik<k&U!$kro|7^;s#

f<6<NhV: rmcorr_cfg KXj5l?3^sITQia<?<r!:7F/@5$# rmcorr_cfg3^sI,+jV7:T9klgKO" wrb -delrbclass -force 3^sIrHQ7F"k<k&Y<9

ro|9k3H,G-^9#

HRMCO0080E rulefile Nk<k&Y<9 rulebase +iNo|K:T7^7?#

b@: k<k&U!$kr"k<k&Y<9+io|9k3H,G-^;sG7?#

79F`NhV: rmcorr_cfg 3^sIO"k<k&Y<9+ik<k&U!$kro|7^;s#

f<6<NhV: rmcorr_cfg KXj5l?3^sITQia<?<r!:7F/@5$# rmcorr_cfg3^sI,+jV7:T9klgKO" wrb -delrbrule -force 3^sIrHQ7F"k<k&Y<9

ro|9k3H,G-^9#

HRMCO0081E k<k&Y<9 %1$s No|K:T7^7?#

b@: rmcorr_cfg 3^sI,"k<k&Y<9ro|9k3H,G-^;sG7?#

79F`NhV: rmcorr_cfg 3^sIO"k<k&Y<9ro|;:Kd_7^9#

f<6<NhV: rmcorr_cfg KXj5l?3^sITQia<?<r!:7F/@5$# wrb -delrb3^sI,+jV7:T9klgKO" rmcorr_cfg 3^sIrHQ7F"k<k&Y<9ro|9k

3H,G-^9#

HRMCO0082E k<k&Y<9 rulebase ro|G-^;s#k<k&Y<9,+U+j^;s#

b@: k<k&Y<9,+U+iJ+C?NG"rmcorr_cfg 3^sIO=lro|9k3H,G-^

;sG7?#

79F`NhV: rmcorr_cfg 3^sIO"k<k&Y<9ro|;:Kd_7^9#

f<6<NhV: {8Nk<k&Y<9rXj7F3^sIrFBT7F/@5$#

HRMCO0085E $YsH&=<9 event_source No|K:T7^7?#

b@: rmcorr_cfg 3^sIO"$YsH&=<9ro|9k3H,G-^;sG7?#

79F`NhV: rmcorr_cfg 3^sIO"$YsH&=<9ro|7^;s#

f<6<NhV: Tivoli D-r!:7",WK~8F3^sIrFBT7F/@5$#FY:T9kl

gKO"wdelsrc 3^sIrHQ7F=N$YsH&=<9r|n7F/@5$#

HRMCO0096E Prolog U!$kN3sQ$kG(i<,/87^7?: filename

b@: prolog U!$kO3sQ$k5l^;sG7?#GbD=-Nb$6xH7FO"=8(i<,

^^lF$k3H,M(il^9#

79F`NhV: rmcorr_cfg 3^sIO"0;7?3^sIr9YFPC/"&H7^9#

f<6<NhV: rmcorr_cfg KO5l?Qia<?<r!:7F/@5$#=8(i<,J$+"

Risk Manager N=.U!$kr!:7F/@5$#c2N\Y,J$+"$BINDIR/RISKMGR/corr G#l

/Hj<bN ptc* (* Otz) r!:7F/@5$#3^sIrFBT7F/@5$#

266 P<8gs 3 jj<9 8

HRMAR0001E (script) ’-r seconds’ *W7gs,,WG9#

b@: ?9/^?O8gV&9/jWHK"-r z-t,"j^;s#9/jWHO"Xj5l?Cth

jbE$$YsH@1r"<+$V7^9#

79F`NhV: Risk Manager NG<?N"<+$VO5oKTol^;s#

f<6<NhV: 9/jWHK -r z-trXj7F/@5$#10 CJeNMrHQ9k,W,"j^

9#

HRMAR0002E (script) INTERP ,_j5lF$^;s#l~G#l/Hj<rhail^;sG7?#

b@: ?9/^?O8gV&9/jWHO"=_N*Zl<F#s0&79F`r=LG-J+C??

aK"l~G#l/Hj<H7FHQ9kG#l/Hj<r=L9k3H,G-^;sG7?#

INTERP D-Qt,*Zl<F#s0&79F`rjA7F$^9#


f<6<NhV: Tivoli D-,,ZK$s9H<k5l"=.5l"T/7F$k3HrN'7F/@

5$#

HRMAR0003E (script) l~G#l/Hj< dir ,8_7F$^;s#

b@: l~G#l/Hj<,U!$k&79F`K8_7F$J$+"G#l/Hj<GOJ/U!$

kH7F8_7F$^9#


f<6<NhV: u-G#9/&9Z<9,"k3HrN'7F/@5$#Xj5l?G#l/Hj<

,8_7F$J$lgO"=lrn.7F/@5$#?9/^?O8gVrFBT7F/@5$#

HRMAR0004E (script) ’wgetrim RIM_object’ ,:T7^7?#

b@: ?9/^?O8gV&9/jWH,"Tivoli RDBMS Interface Module (RIM) ^?OXj5l?

RIM *V8'/HK"/;9G-^;sG7?# wgetrim 3^sI+iNaC;<8K\7$b@,

^^lF$klg,"j^9#


f<6<NhV: Tivoli D-,T/7F*j"RIM N!=rBT9k?aN57$rdHvDr}CF

$k3HrN'7F/@5$#Xj5l? RIM *V8'/H,n.5lF$k3HrN'7F+i"?

9/^?O8gVrFBT7F/@5$#

HRMAR0005E (script) RIM 3^sI&U!$krn.G-^;s: file#

b@: 9/jWHO"(5lF$kU!$krn.9k3H,G-^;sG7?#


f<6<NhV: Tivoli D-,T/7F*j"u-G#9/&9Z<9,"j"79F`Nl~G#l

/Hj<KP9kq-~_vDr}CF$k3HrN'7F/@5$#?9/^?O8gVrFBT7

F/@5$#


A.

Risk

Man

ager�$+&

�0

Web ��$+&�0

HRMWN0001E *rKhk wrimsql XNFSP7K:T7^7?#*;7^9#

b@: G<?Y<9K"/;9G-J+C?+"select NQia<?<,mCF$^7?#

79F`NhV: G<?O"G<?Y<9+ihjP5l^;sG7?#

f<6<NhV: G<?Y<9r!:7"F/K+k&5]<HK"m7F/@5$#

HRMWN0003E l~G#l/Hj<,8_7^;s#*;7^9#

b@: Wm0i`KO"h}N?aNl~G#l/Hj<,,WG9#

79F`NhV: Wm0i`OBT7J$G*;7^7?#

f<6<NhV: Unix WiCHU)<`NlgO /tmp K"Windows WiCHU)<`NlgO

/temp Kl~G#l/Hj<rn.7F/@5$#

Risk Manager Event Integration Facility �$+&�0

HRMRM0008E `n(i<: aC;<8rw.G-^;s#

b@: $YsHr Risk Manager EIF G<bsKw.9k]KlLc2,/87^7?#

79F`NhV: $YsHO Risk Manager EIF G<bsKOw.5l^;sG7?#

f<6<NhV: Risk Manager EIF H TEC =.r!:7"F/K+k&5]<HK"m7F/@5

$#

HRMRM0009E 9Hl<8Ndj6jfKc2#

b@: Risk Manager EIF G<bsG9Hl<8rdj6k]KlLc2,/87^7?#

79F`NhV: Risk Manager EIF G<bsO"aj3<I -1 G*;7^9

f<6<NhV: O<I&'"H OS =UH&'"N=.rA'C/7F/@5$#

HRMRM0016E &L"@W?<NQ$Wh}K:T7^7?#rc = return code#

b@: Risk Manager EIF G<bsNL.Q$WNI_hj^?Oq-~_K:T7^7?#

79F`NhV: Risk Manager EIF G<bsO"aj3<I -1 G*;7^9#

f<6<NhV: Risk Manager EIF N=.r!:7"F/K+k&5]<HK"m7F/@5$#

HRMRM0017E &L"@W?<Ni|=K:T7^7?#rc = return code#

b@: Risk Manager EIF G<bsNi|=K:T7^7?#



268 P<8gs 3 jj<9 8

HRMRM0018E &LG<bsXNQ9NhjK:T7^7?#

b@: Risk Manager EIF G<bsO"$s9H<k&Q9rrh9k3H,G-^;sG7?#


f<6<NhV: Risk Manager EIF N=.Hl89Hj<`\rA'C/7"F/K+k&5]<HK

"m7F/@5$#

HRMRM0019E D-Qt LCF_DATDIR ,_j5lF$^;s#

b@: Risk Manager EIF G<bs (TME P<8gs) ,"Xj5l?Q9r=L9k3H,G-^;

sG7?#



"m7F/@5$#

HRMRM0020E D-Qt NSLPATH ,_j5lF$^;s#

b@: Risk Manager EIF G<bsO"Xj5l?Q9r=L9k3H,G-^;sG7?#



"m7F/@5$#

HRMRM0021E uV;Û)<Nn.K:T7^7?#rc = return code#

b@: Risk Manager EIF G<bsO")f;Û)<rn.9k3H,G-^;sG7?#



HRMRM0022E uV;Û)<N|nK:T7^7?#ERRNO = errno#

b@: Risk Manager EIF G<bs,")f;Û)<r|n9k3H,G-^;sG7?#



HRMRM0023E uV;Û)<Nh@K:T7^7?#ERRNO = errno#

b@: Risk Manager EIF G<bs,")f;Û)<K"/;99k3H,G-^;sG7?#




A.

Risk

Man

ager�$+&

�0

HRMRM0024E uV;^U)<&H</sNh@K:T7^7?#ERRNO = errno#

b@: Risk Manager EIF G<bs,")f;^U)<&H</sK"/;99k3H,G-^;sG7

?#



HRMRM0025E ]<HVf port number r-zJMK_j9k,W,"j^9#

b@: 5zJm<+k&$YsHh}]<HVf,"Risk Manager EIF N=.U!$kKjA5lF$

^9#


f<6<NhV: =.U!$kK-zJ]<HVfrXj7F/@5$#

HRMRM0026E m<+k&$YsHh}rWa9k~KO]<HVfr_j9k,W,"j^9#

b@: m<+k&$YsHh}, Risk Manager EIF N=.U!$kKXj5lF$^9,"]<HV

f,jA5lF$^;s#


f<6<NhV: =.U!$kK-zJ]<HVfrXj7F/@5$#

HRMRM0027E CDS U!$k [CDS file name] (U!$k [] KjA5lF$k) ,8_7F$^;s#

b@: =.U!$kKjA5lF$k CDS U!$k,8_7F$^;s#


f<6<NhV: -zJ .cds U!$kr=.U!$kKXj7F/@5$#

HRMRM0028E CDS U!$krONi|=K:T7^7?#rc = return code#

b@: .cds U!$krOK:T7^7?#


f<6<NhV: .cds *hS .fmt U!$k,lW7F$k3HrN'7F/@5$#

HRMRM0029E ServerLocation , [configuration file] U!$kKjA5lF$^;s#

b@: 5<P<&m1<7gs, Risk Manager EIF N=.U!$kKjA5lF$^;s#


f<6<NhV: -zJ ServerLocation r Risk Manager EIF =.U!$kKXj7F/@5$#

270 P<8gs 3 jj<9 8

HRMRM0030E &L"@W?<QN=.U!$kNh@K:T7^7?#

b@: Risk Manager EIF G<bs,"=N=.U!$kK"/;99k3H,G-^;sG7?#


f<6<NhV: =.U!$k,57$m1<7gsK8_7F$k3HrN'7F/@5$#

HRMRM0031E TEC EIF Ni|=K:T7^7?#aj3<I = return code#

b@: Risk Manager EIF G<bs,"TEC HNL.ri|=9k3H,G-^;sG7?#


f<6<NhV: Risk Manager EIF *hS TEC N=.r!:7"F/K+k&5]<HK"m7F/

@5$#

HRMRM0032E L.Q$WNn.K:T7^7?#

b@: Risk Manager EIF G<bs,"btNL.Q$Wrn.9k3H,G-^;sG7?#



HRMRM0033E TEC OsIkNn.K:T7^7?#tec_errno = return code.

b@: Risk Manager EIF G<bs,"TEC L.OsIkrn.9k3H,G-^;sG7?#



@5$#

HRMRM0034E I_hjQNL.Q$W pipe name r*<Ws7h&H7F:T7^7?"errno =#

b@: Risk Manager EIF G<bs,"I_hjQNbtL.Q$Wr*<Ws9k3H,G-^;sG

7?#



HRMRM0035E q-~_QNL.Q$W pipe name r*<Ws7h&H7F:T7^7?"errno =#

b@: Risk Manager EIF G<bs,"q-~_QNbtL.Q$Wr*<Ws9k3H,G-^;sG

7?#




A.

Risk

Man

ager�$+&

�0

HRMRM0036E L.Q$W pipe name r*<Ws7h&H7F:T7^7?"errno =#

b@: Risk Manager EIF G<bs,"L.Q$Wrn.9k3H,G-^;sG7?#



HRMRM0037E aC;<8&?$W*hSaC;<8&5$:NI_hjK:T7^7?#

b@: Risk Manager EIF G<bs,"btNL.Q$W+iaC;<8&?$WrI_hk3H,G-

^;sG7?#



HRMRM0038E &L"@W?<,aC;<8&G<?NI_hjK:T7^7?#

b@: Risk Manager EIF G<bs,"btNL.Q$W+iaC;<8&G<?rI_hk3H,G-

^;sG7?#


f<6<NhV: Risk Manager EIF G<bsrA'C/7"F/K+k&5]<HK"m7F/@5

$#

HRMRM0039E aC;<8NU)<^CH_jK:T7^7?#- aj3<I = return code#

b@: Risk Manager EIF G<bs,"w.5l?aC;<8&G<?rU)<^CH_j9k3H,G

-^;sG7?#

79F`NhV: Risk Manager EIF G<bsO"aj3<I -1 r Risk Manager EIF &Qi$Vij

<Ka7^9#


HRMRM0040E CDS U!$k,jA5lF$^;s#$YsHrU)<^CH_jG-^;s#

b@: Risk Manager EIF G<bs,U)<^CH9Y-$YsHru1hj^7?,".cds U!$k,

8_7F$^;s#


<Ka7^9#

f<6<NhV: Risk Manager EIF =.rA'C/7".cds U!$k,8_7F$k3H"*hS=N

U!$k, Risk Manager EIF =.U!$kGjA5lF$k3HrN'7F/@5$#

HRMRM0041E *;aC;<8rm<+k&$YsHh}Wm0i`Kw.7h&H7F:T7^7?#

b@: Risk Manager EIF G<bs,"*;aC;<8rm<+k&$YsHh}Wm0i`Kw.9k

3H,G-^;sG7?#


<Ka7^9#


272 P<8gs 3 jj<9 8

HRMRM0042E aC;<8NU)<^CH_jK:T7^7?#

b@: Risk Manager EIF G<bs,"$YsHrU)<^CH_j9k3H,G-^;sG7?#


<Ka7^9#


HRMRM0043E U)<^CH_j9ke.G<?,5zG9#

b@: Risk Manager EIF G<bs,"5zJ$YsH&G<?ru1hj^7?#


<Ka7^9#


HRMRM0044E m<+k&$YsHh}Wm0i`N=1CHNn.K:T7^7?#

b@: Risk Manager EIF G<bs,"L.=1CHNn.K:T7^7?#


<Ka7^9#


HRMRM0045E m<+k&$YsHh}Wm0i`XN\3K:T7^7?#

b@: Risk Manager EIF G<bs,"L.=1CHHN\3K:T7^7?#


<Ka7^9#


HRMRM0046E $YsHrm<+k&$YsHh}Wm0i`Kq-~b&H7F:T7^7?#

b@: Risk Manager EIF G<bs,"L.=1CHXNq-~_K:T7^7?#


<Ka7^9#


HRMRM0047E $YsHNw.K:T7^7?#rc = return code#

b@: Risk Manager EIF G<bs,"$YsHr TEC Kw.9kH-K(i<NajMru1hj^

7?#


<Ka7^9#


@5$#


A.

Risk

Man

ager�$+&

�0

HRMRM0048E uV;^U)<Nn.K:T7^7?"errno = errno#

b@: Risk Manager EIF G<bsO")f;^U)<rn.9k3H,G-^;sG7?#



HRMRM0049E winsock.dll N+OfK retun code ,a5l^7?#

b@: Risk Manager EIF G<bsO"Windows N=1CHL.rO09k3H,G-^;sG7?#

79F`NhV: Risk Manager EIF G<bs,"WSAStartup +ia5l?aj3<IG*;7^7

?#

f<6<NhV: Risk Manager EIF H OS =.r!:7"F/K+k&5]<HK"m7F/@5

$#

HRMRM0050E GPC0 (s5<S9) b<IGBTfG9#

b@: Risk Manager Observer O"GPC0 (s5<S9) N<IGBTfG9#

HRMRM0051E 5<S9r$s9H<k7F/@5$#

b@: Risk Manager Observer NHQeNh^j8gG9#

HRMRM0052E RMO -r : 5<S9N|n#

b@: Risk Manager Observer NHQeNh^j8gG9#

HRMRM0053E 5<S9r$s9H<kG-^;s: Service name#

b@: Risk Manager Observer 5<S9,$s9H<kK:T7^7?#

79F`NhV: Risk Manager Observer 5<S9O":T7?"Wj1<7gsh}$s?<U'<9

(API) +iNaj3<IG*;7^9#

f<6<NhV: Risk Manager Observer N=.r!:7"F/K+k&5]<HK"m7F/@5$#

HRMRM0054E 5<S9&-<Mr_j7F/@5$#

b@: Risk Manager Observer 5<S9,$s9H<kK:T7^7?#

79F`NhV: Risk Manager Observer 5<S9,":T7? API +iNaj3<IG*;7^9#

f<6<NhV: Risk Manager Observer N=.rA'C/7"F/K+k&5]<HK"m7F/@5

$#

274 P<8gs 3 jj<9 8

HRMRM0055E 5<S9&-<rn.7F/@5$#

b@: Risk Manager Observer 5<S9,"l89Hj<`\rn.9k3H,G-^;sG7?#

79F`NhV: Risk Manager Observer 5<S9O":T7? API +iNaj3<IG*;7^9#


HRMRM0056E !Ni$Vij<rm<IG-^;s: Library name#

b@: Risk Manager Observer 5<S9O"Java >[^7sN DLL rm<I9k3H,G-^;sG

7?#

79F`NhV: Risk Manager Observer 5<S9O"<mJ0NajMG*;7^9#


HRMRM0057E JVM rn.G-^;s#(i<&3<I: return code#

b@: Risk Manager Observer 5<S9O"Java >[^7sN$s9?s9rn.9k3H,G-^;

sG7?#



HRMRM0058E /i9 return code ,+U+j^;s#

b@: Risk Manager Observer 5<S9O"RMO /i9r+U1k3H,G-^;sG7?#


f<6<NhV: Risk Manager Observer =.r!:7"F/K+k&5]<HK"m7F/@5$#

HRMRM0059E Java a=CI ID ,+U+j^;s#

b@: Risk Manager Observer 5<S9O RMO /i9bN Main a=CIr+U1k3H,G-^;

sG7?#



HRMRM0060E Service name - (i<:

b@: Risk Manager Observer N(i<&9Hjs0G9#

HRMRM0063E Risk Manager Observer r+OG-^;s#

b@: Risk Manager Observer O+O9k3H,G-^;sG7?#




A.

Risk

Man

ager�$+&

�0

HRMRM0064E Risk Manager Observer rd_G-^;s#

b@: Risk Manager Observer Od_9k3H,G-^;sG7?#



Risk Manager EIF Observer �$+&�0

HRMJR0003E TVf line number G*;9kk<kN(i<G9#

b@: =N=8,!:5lF$kk<k&U!$kK"k<k,5zKJk6xHJk(i<,^^l

F$^9#

79F`NhV: Risk Manager EIF Nm<+k&$YsHh}(s8sH;Q9kH"k<k&U!$

kO5oK0n7^;s#

f<6<NhV: k<k&U!$kbN(i<r{57F/@5$#

HRMJR0004E k<kN*ojK;_3ms,"j^;s#

b@: =N=8,!:5lF$kk<k&U!$kK";_3ms,^^lF$^;s#k<k&U!

$kO5zG9#


kO5oK0n7^;s#


HRMJR0005E k<kNc2: failing rule

b@: j9H5lF$kk<kK"=8(i<,^^lF$^9#


kO5oK0n7^;s#


HRMJR0006E U!$k file name ,+U+j^;s#

b@: Wm0i`OU!$kr*<Ws9k3H,G-^;sG7?#

79F`NhV: Risk Manager EIF m<+k&$YsHh}Wm0i`G3Ndj,/87?lg"=

NWm0i`O[o*;7^9#lgKhCFOh},Q39k3H,"j^9,"E#$YsHNo

:OBT5l^;s#

f<6<NhV: U!$k>,57/Wm0i`KO5lF$k3HrN'7F/@5$#

276 P<8gs 3 jj<9 8

HRMJR0007E m<+k&$YsHh}G]<H port number rP$sIG-^;s#

b@: m<+k&$YsHh}Wm0i` (rmo) O"$RMADHOME/etc/rmad.conf =.U!$kG

LocalEventPort H7FXj5l?]<Hr*<Ws9k3H,G-^;s#

79F`NhV: m<+k&$YsHh}Wm0iÒ:T7^9#

f<6<NhV: ]<Hr"79F`GHQD=J]<HKQ97F/@5$#

Web IDS �$+&�0

HRMWI0001E U!$k file_name rI_hj`nQK*<WsG-^;s#

b@: Xj5l? Web 5<P<Nm0,+U+j^;sG7?#

f<6<NhV: -zJU!$k>Gdj>7F/@5$#

79F`NhV: U!$k,+U+j^;s#Wm0iÒd_7^7?#

HRMWI0002E Webids N=.U!$kG Risk Manager Event Integration Facility i$Vij<NQ9,57/_

j5lF$^;s#

b@: TEC 5<P<Kpsrw.9k?aK,WJ Risk Manager Event Integeration Facility i$Vi

j<&U!$kr+U1il^;sG7?#

f<6<NhV: =.U!$kbN librmadPath Mr",ZJG#l/Hj<rX9h&KQ97^

9#

79F`NhV: i$Vij<,+U+j^;s#$YsHOw.5l^;s#

HRMWI0005E =.U!$kK variable_name ,,WG9#=.U!$kKIC7",WK~8F"Web 5<P<Nm

0&U!$kKbIC7F/@5$#

b@: Web IDS ,0n9k?aK,WJQt,"=.U!$kK"j^;s#

f<6<NhV: gn7F$kQtr=.U!$kKIC7"=lK,ZJMrdjvFF/@5$#

79F`NhV: Qt,+U+j^;s#Wm0iÒd_7^7?#

HRMWI0006E hZj8zNXj,J$NG|Ur57/rOG-^;s#hZj8zH"|U^?O|Upsr=.

U!$kG407F/@5$#

b@: Web IDS K"|UN57$,d}!r'15;k,W,"j^9#7?,CFhZj8z,,W

KJj^9#

f<6<NhV: date_delim NMr=.U!$kGXj7F/@5$#

79F`NhV: hZj8z,Xj5lF$^;s#|UO57/rO5l^;s#


A.

Risk

Man

ager�$+&

�0

HRMWI0007E file_name <line_number> key_name O-z-<GO"j^;s#

b@: -<,'15l^;sG7?#lLK"-zJ-<O ″value″ ^?O ″delim″ G9#

f<6<NhV: -<r-zJM (″value″ ^?O ″delim″) KQ97F/@5$#

79F`NhV: (i<,sp5l^7?,"BTrQ37^9#

HRMWI0008E =.U!$kK dictionary_value ,"j^;s#dictionary_value rIC9k+"G#/7gJj<

J0NbNrHQ9kh&K logPattern_value rQ97F/@5$#

b@: =.U!$kK"Qt dictionary_value ,"j^;s#

f<6<NhV: dictionary_value r=.U!$kKIC7"=lK,ZJMrdjvFF/@5$#

79F`NhV: Qt,+U+j^;s#Wm0iÒd_7^7?#

HRMWI0009E hZj8zrXj7J$H"G#/7gJj<r57/rOG-^;s#=.U!$kbNhZj8

z"G#/7gJj<ps"^?O=N>}r407F/@5$#

b@: =.U!$kGG#/7gJj<MrXj9klgO"G#/7gJj<NhZj8zbXj9

k,W,"j^9#

f<6<NhV: dictionary_delim NMr=.U!$kGXj7F/@5$#

79F`NhV: G#/7gJj<NhZj8z,+U+j^;s#Wm0iÒd_7^7?#

HRMWI0010E !NhZj8zj9HrHQ7FG#/7gJj<r57/rO9k3H,G-^;sG7?: user

specified valid delimiters

b@: Xj5l?hZj8zj9HrHQ7F"Web 5<P<Nm0bNG#/7gJj<`\r,d

9k3H,G-^;s#7?,CF"3NG#/7gJj<`\r}r9k3H,G-^;s#

f<6<NhV: -zJhZj8zj9Hr=.U!$kGXj7F/@5$#

79F`NhV: G#/7gJj<NhZj8z,5zG9#Wm0iÒd_7^7?#

HRMWI0011E CLF N=.U!$kN-<M,6 (false) K_j5lF$^9,"logPattern M,_j5lF$^;

s#=.U!$krT87F"Wm0i`rFO07F/@5$#

b@: m0&U!$k, CLF A0GJ$3H, Web IDS KLN5l^7?," Web IDS O=Nm

0&U!$kNI_hj}rX(5lF$^;s#

f<6<NhV: logPattern_value NMr=.U!$kGXj9k+"m0&U!$k,B]K CLF

A0G"klgO"clf_value r 1 KQ97F/@5$#

79F`NhV: m0&U!$kr}r9k3H,G-^;s#Wm0iÒd_7^7?#

HRMWI0012E hZj8zrXj7J$H"logPattern r57/rOG-^;s#hZj8zH logPattern ^?OlogPattern psr=.U!$kG407F/@5$#

b@: =.U!$kK logPattern MrXj9klgO"logPattern NhZj8zbXj9k,W,"j

^9#

f<6<NhV: logPattern_delim NMr=.U!$kGXj7F/@5$#

79F`NhV: logPattern NhZj8z,+U+j^;s#Wm0iÒd_7^7?#

278 P<8gs 3 jj<9 8

HRMWI0013E !NhZj8zj9HrHQ7F logPattern r57/rO9k3H,G-^;sG7?: user specified

valid delimiters

b@: Xj5l? logPattern hZj8zj9HrHQ7F"logPattern Mr3s]<MsHK,d9k

3H,G-^;sG7?#


79F`NhV: logPattern NhZj8z,5zG9#Wm0iÒd_7^7?#

HRMWI0014E !NhZj8zj9HrHQ7F|Ur57/rO9k3H,G-^;sG7?: user specified valid

delimiters

b@: Xj5l?|UNhZj8zj9HrHQ7F"|UMr3s]<MsHK,d9k3H,G-

^;sG7?#


79F`NhV: |UNhZj8z,5zG9#Wm0iÒd_7^7?#

HRMWI0015E hZj8zrXj7J$H"~or57/rOG-^;s#hZj8z"~ops"^?O=N>}r

=.U!$kG407F/@5$#

b@: =.U!$kK~oMrXj9klgO"~oNhZj8zbXj9k,W,"j^9#

f<6<NhV: time_delim NMr=.U!$kGXj7F/@5$#

79F`NhV: ~oNhZj8z,+U+j^;sG7?#Wm0iÒd_7^7?#

HRMWI0016E !NhZj8zj9HrHQ7F~or57/rO9k3H,G-^;sG7?: user specified valid

delimiters

b@: Xj5l?~oNhZj8zj9HrHQ7F"~oMr3s]<MsHK,d9k3H,G-

^;sG7?#


79F`NhV: ~oNhZj8z,5zG9#Wm0iÒd_7^7?#

HRMWI0017E /i9 ’name’ O9GK ’engine_name’ (s8sKXj5lF$^9#

b@: ?(il?(s8sbNF/i9KO"G-N>0rU1k,W,"j^9#

f<6<NhV: 70KAc<&U!$kbNE#7F$k/i9N 1 DN>0rQ97F/@5$#

79F`NhV: /i9>rE#5;^9#

HRMWI0018E U!$k ’signature_file_name’ K5zJ70KAc< ’signature name’ ,"j^9#1 TKO"2 `\^

?O 4 `\rHQG-^9#

b@: 70KAc<O"Q?<sH>0"^?OQ?<s">0"79F`Ne@ ID *hS79F`

Ne@G<?Y<9N>0N$:l+G=.5lF$^9#7?,CF"Ag&I 2 D^?O 4 DN

U#<kIr}?J$70KAc<O"5zG9#

f<6<NhV: ,WJtNU#<kIr}Dh&K70KAc<rQ97F/@5$#

79F`NhV: 70KAc<,5zG9#Wm0iÒd_7^7?#


A.

Risk

Man

ager�$+&

�0

HRMWI0019E 70KAc<&U!$k ’signature_file_name’ K,\/i9 ’engine(class_name)’ ,"j^;s#

b@: Web IDS ,5oK0n9kKO"$/D+N/i9,,WG9#

f<6<NhV: sig.nefarious NPC/"CW&3T<+i",\N/i9r|57F/@5$#

79F`NhV: ,\N/i9,"j^;s#Wm0iÒd_7^7?#

HRMWI0020E (s8s ’engine_name’ N ’class_name’ /i9N70KAc<r>AG-^;s#

b@: 70KAc<&U!$kGjA5lF$k70KAc<NQ?<sO"5zJ5,==G9#

f<6<NhV: -zJ5,==KJkh&K70KAc<rQ97",ZK>AG-kh&K7F/

@5$#

79F`NhV: 70KAc<NQ?<s,5zG9#Wm0iÒd_7^7?#

HRMWI0021E /i9 ’class_name’ N,\Qia<?< ’parameter_name’ K5zJ=8,"j^9#

b@: CjN/i9NQia<?<,mCF$^9#

f<6<NhV: =N(s8s^?O/i9KG-N=8K`r9kh&"Qia<?<rQ97F/

@5$ (3asHrIsG/@5$)#

79F`NhV: Wm0iÒd_7^7?#

HRMWI0022E 70KAc<&U!$k ’signature_file_name’ K5zJ(s8s> ’engine_name’ ,+U+j^7?#

b@: (s8s>O"skip"parser"pattern"trust"*hS suspicion N$:lGb"j^;s#

f<6<NhV: 9YFN/i9H70KAc<r"s!5lF$k(s8sN 1 DKjA7F/@5

$#

79F`NhV: (s8s>,5zG9#Wm0iÒd_7^7?#

HRMWI0023E 70KAc<&U!$k ’signature_file_name’ G suspicion (s8sK5zJ printLvl ’print_level’ ,Xj5l^7?#

b@: printLvl O"all"warnings"^?O alerts N$:l+GJ1lPJj^;s#

f<6<NhV: printLvl r3li 3 DN-zJMNbN 1 DK_j7F/@5$#

79F`NhV: printLvl ,5zG9#Wm0iÒd_7^7?#

HRMWI0024E 70KAc<&U!$k ’%2$s’ G suspicion (s8sK5zJQia<?< ’%1$s’ ,Xj5l^

7?#

b@: suspicion (s8sNQia<?<,mCF$^9#=8,mCF$k+"Qia<?<,

printLvl (#lN-zJQia<?<) GO"j^;s#

f<6<NhV: Qia<?<H7F printLvl N_r}Dh&K(s8srXj7F/@5$#


280 P<8gs 3 jj<9 8

HRMWI0025E (s8s ’engine_name’ O"70KAc<&U!$k ’ signature_file_name’ bN>,JQia<?<r

u1~l^;s#

b@: 3N(s8sjAOQia<?<ru1hj^;s#7?,CF"33GjA5lF$kbNO

9YFU#,"j^;s#Qia<?<ru1hkNO"suspicion (s8s@1G9#

f<6<NhV: 3N(s8sNQia<?<r|n7F/@5$#

79F`NhV: (s8sNQia<?<,5zG9#Wm0iÒd_7^7?#

HRMWI0026E 70KAc<&U!$k ’signature_file_name’.printLvl bG"suspicion (s8s ’suspicion’ KprintLvl ,Xj5lF$^;s#

b@: Qia<?< printLvl r suspicion (s8sKXj9k,W,"j^9#

f<6<NhV: (s8sKQia<?< printLvl rXj7F/@5$#


HRMWI0027E 70KAc<&U!$k ’signature_file_name’ G"(s8s ’engine_name’ N/i9 ’class_name’ Klevel1"level2"^?O k Qia<?<,Xj5lF$J$+""k$O5zG9#

b@: level1"level2"*hS k Qia<?<O"/i9jA4HK57/Xj9k,W,"j^9#3

Nlg"=liNQia<?<,Xj5lF$J$+"=NjA,mCF$^9#

f<6<NhV: T,ZJM,J$+"3NCjN/i9NQia<?<r,O7F/@5$#

79F`NhV: Qia<?<,T,ZG9#Wm0iÒd_7^7?#

HRMWI0028E 3N70KAc<&U!$k ’signature_file_name’ bN(s8s ’engine_name’ N/i9 ’class_name’ Nlevel1 O level2 hjg-/J1lPJj^;s#

b@: Level1 O"Level2 J<G9#D^j"V[9H4HWN"i<H,8.5lk?SK"i9J

VIa$s4HWN"i<Hb8.5lk3HrU#7^9#

f<6<NhV: Level1 r Level2 hjb$/i+g-/_j7F/@5$#


HRMWI0029E 70KAc<&U!$k ’signature_file_name’ G"(s8s ’engine_name’ N/i9 ’class_name’ K"5

zJ level1"level2"^?O k z-t,Xj5l^7?#

b@: level1"level2"*hS k Qia<?<O"/i9jA4HK57/Xj9k,W,"j^9#3

NlgO"=liNQia<?<NjA,mCF$^9#

f<6<NhV: T,ZJM,J$+"3NCjN/i9NQia<?<r,O7F/@5$#

79F`NhV: Qia<?<,T,ZG9#Wm0iÒd_7^7?#


A.

Risk

Man

ager�$+&

�0

HRMWI0030E 70KAc<&U!$k ’signature_file_name’ G"(s8s ’engine_name’ N/i9 ’class_name’ KU#<kI&Qia<?<,"j^;s#

b@: U#<kI&Qia<?<O"3N/i9bN70KAc<KM-go;kH-K"m0`\N

INt,r+k+rXj7^9#U#<kI&Qia<?<,J$lgKO"Web IDS OI3r+lP

h$N+,o+j^;s#

f<6<NhV: /i9NQia<?<H7FU#<kI>rXj7^9#



zJU#<kI> ’field_name’ ,Xj5l^7?#

b@: U#<kI>Ou1~lD=JMN 1 DGO"j^;s#7?,CF"U#<kI>O Web

IDS KHCFO4/U#,"j^;s#

f<6<NhV: U#<kINMr"″url″ JINu1~lD=JMK_j7F/@5$#



zJro ’operator’ ,Xj5l^7?#

b@: ’!’ ^?O ’=’ J0Nro,Xj5l^7?#

f<6<NhV: ror,O7"=lr,ZG-zJi;RKQ97F/@5$#


HRMWI0033E 70KAc<&U!$k ’signature_file_name’ G"(s8s ’engine_name’ N/i9 ’class_name’ Kcancel Qia<?<,Xj5lF$^;s#

b@: trust (s8sbN/i9KO"5zK9k$YsHN/i9rXj9k cancel Qia<?<,

,WG9#

f<6<NhV: Web IDS ,"3N/i9NM-go;NkL"IN$YsHr5zK9kN+,o+

kh&K" cancel Qia<?<rXj7F/@5$#


HRMWI0034E 70KAc<&U!$k ’signature_file_name’ G"(s8s ’engine_name’ N/i9 ’class_name’ Ncancel Qia<?<K"5zJ/i9> ’cancelled_class_name’ ,Xj5l^7?#

b@: cancel Qia<?<,U#r}DNO"=l,=_8_7F$k/i9rXj7F$klgN_

G9#D0J,i"3N/i9NQia<?<O8_7F$^;s#

f<6<NhV: cancel Qia<?<,"8_7F$k/i9rXj7F$k3HrN'7F/@5

$#


282 P<8gs 3 jj<9 8

HRMWI0035E 70KAc<&U!$k ’signature_file_name’ G"(s8s ’engine_name’ N/i9 ’class_name’ N,\

Qia<?<K"5zJ/i9> ’required_class_name’ ,Xj5l^7?#

b@: require Qia<?<,U#r}DNO"=l,=_8_7F$k/i9rXj7F$klgN_

G9#D0J,i"3N/i9NQia<?<O8_7F$^;s#

f<6<NhV: require Qia<?<,"8_7F$k/i9rXj7F$k3HrN'7F/@5

$#


HRMWI0036E 5zJ"i<H&G<?=$G9#

b@: "i<H&G<?=$G"kbtN Web IDS =$,ulF$^9#

f<6<NhV: Web IDS rFO07F/@5$#


HRMWI0037E (s8s ’engine_name’ N/i9 ’class_name’ NlYk ’which_level’ ,=LG-^;s#

b@: btN Web IDS =$,ulF$^9#



HRMWI0038E (s8s ’engine_name’ N/i9 ’class_name’ N K M,=LG-^;s#

b@: btN Web IDS =$,ulF$^9#



HRMWI0039E "Wj1<7gs&$YsH&m0r*<WsG-^;s#

b@: NT $YsH&m0HNL.Kdj,"j^9#

f<6<NhV: Web IDS rFO07F/@5$#dj,+jV7/89klgKO"79F`rjV

<H7F/@5$#

79F`NhV: L.Kdj,"j^9#Wm0i`Od_7^7?#

HRMWI0040E Risk Manager Event Integration Facility K$YsHrw.G-^;s#

b@: Web IDS KO"RMEIF HNL.Kdj,"j^9#=.K?i+NVc$,"k+"l~*J

djK9.J$+NIAi+G9#

f<6<NhV: aC;<8,lY7+/87J$lgO"?b7J$G/@5$#=lJ0Nlg

O"Web IDS rd_7"3^sITG wrmadmin -restart r~O7F Web IDS rFO07F/@5

$#

79F`NhV: L.Kdj,"j^9#BTOQ37^9#


A.

Risk

Man

ager�$+&

�0

284 P<8gs 3 jj<9 8

!��%�

3NU?GO"Risk Manager N0NP<8gs+i^$0l<7gs9kf<6<Kpsr

s!7^9#

�� 0%� 3.8 ��"�+��Risk Manager "@W?< P<8gs 3.8 JeGHQ5lkU)<^CH&U!$k^?O=

N>N=.U!$kO""@W?<NF$s9H<k^?O"CW0l<IfK"PC/"C

W&G#l/Hj<K]I5l^9#=.U!$kO"!N $RMADHOME/etc/backup G#l/

Hj<K]I5l^9 (RMADHOME O$s9H<k&G#l/Hj<)#

¶ /usr/RISKMGR (AIX Nlg)

¶ /opt/RISKMGR (Solaris *hS Linux Nlg)

¶ %SystemDrive%¥Program Files¥Tivoli¥RISKMGR (Windows NlgNGU)kH)

J<N=.U!$k,]I5l^9#

¶ Risk Manager Event Integration Facility:

$RMADHOME/etc/rmad.conf$RMADHOME/etc/rmad_summary.rules

¶ Web Intrusion Detection System:

$RMADHOME/etc/sig.nefarious$RMADHOME/etc/webids.cfg$RMADHOME/etc/webids.fmt$RMADHOME/etc/webids.nt.fmt

¶ Cisco Secure IDS Q"@W?<:

$RMADHOME/etc/csids.fmt$RMADHOME/etc/csids.nt.fmt


$RMADHOME/etc/cpfw.fmt$RMADHOME/etc/cpfw.nt.fmt$RMADHOME/etc/rma_cpfw.conf

¶ Risk Manager N5]<H&U!$k:

$RMADHOME/etc/os_aix.fmt$RMADHOME/etc/os_solaris.fmt$RMADHOME/etc/os_nt.fmt$RMADHOME/etc/os_linux.fmt$RMADHOME/etc/pix.fmt$RMADHOME/etc/pix_nt.fmt

B


B.!��

��%�

$RMADHOME/etc/rmnav.fmt$RMADHOME/etc/rmmac.fmt$RMADHOME/etc/tecad_snmp.cds$RMADHOME/etc/tecad_snmp.oid

lLK"F$s9H<k^?O"CW0l<IN?aN$s9H<keNh}GO""@W?

<H&K$s9H<k5l?=.U!$kO=N^^D5l^9#=.U!$kN]IQ_P

<8gsrHQ9klgO"=lrPC/"CW&G#l/Hj<+i $RMADHOME/etc G#

l/Hj<K3T<9k3H,G-^9#

F$s9H<k^?O"CW0l<IfK$s9H<k&79F`,"=TP<8gsN

rmad.conf U!$kH rmad_summary.rules U!$kr|57^9,"$s9H<kQ_N

("k$O*j8JkN) P<8gsb]I7^9# Risk Manager OJ<N"/7gsrBT

7F"rmad.conf U!$kH rmad_summary.rules U!$krh}7^9#

¶ U!$k4HK $RMADHOME/etc/File r $RMADHOME/etc/backup/File.orig X\07^

9#

¶ U!$k4HK $RMADHOME/etc/backup/File r $RMADHOME/etc/File K\07^9#

33G"File O"rmad.conf ^?O rmad_summary.rules rX7^9#

Risk Manager ��0%� 3.7 �� !��%�

"@W?<, Risk Manager P<8gs 3.7 rHQ7F9GK (Tivoli QC1<8^?O

TME J0N tar QC1<8N$:l++i) $s9H<k5lF$klgO"P<8gs

3.8 N"@W?<NF$s9H<kh}fK"J<N^$0l<7gsnH,BT5l^9#

AIX *hS Solaris 79F`Nlg:

¶ rma_app_env.sh D-9/jWHbNpsKhCF" 3.7 N$s9H<kNm1<7gs

,h^j^9 (app O"CjN"@W?<r=7"eif"cpfw"nr"web"^?O perl N$

:l+HJj^9)#

¶ f<6<,=.D=JG<?r^`=.U!$k,"PC/"CW&G#l/Hj<

$RMADHOME/etc/backup bN7,N$s9H<k&m1<7gsK3T<5l^9#J<N

"@W?<N=.U!$k,]I5l^9#

v Risk Manager Event Integration Facility

v Web Intrusion Detection System

v Cisco Secure IDS Q"@W?< (J0O NetRanger H7FNilF$^7?)

v Check Point FireWall-1 Q"@W?<

m: J<N Risk Manager N5]<H&U!$kO"P<8gs 3.7 NU!$kNm1<

7gs+iO3T<5l^;s#^?"|nb5l^;s#=liNU!$kNm1

<7gsr=L9k}!,J$+iG9#

v Risk Manager Event Integration Facility:

$RMADHOME/etc/rmad.conf$RMADHOME/etc/rmad_summary.rules

v Web Intrusion Detection System:

286 P<8gs 3 jj<9 8

$RMADHOME/etc/sig.nefarious$RMADHOME/etc/webids.cfg$RMADHOME/etc/webids.fmt$RMADHOME/etc/webids.nt.fmt

v Cisco Secure IDS QN"@W?<:

$RMADHOME/etc/csids.fmt$RMADHOME/etc/csids.nt.fmt

v Check Point FireWall-1 Q"@W?<:

$RMADHOME/etc/cpfw.fmt$RMADHOME/etc/cpfw.nt.fmt$RMADHOME/etc/rma_cpfw.conf

v Risk Manager N5]<H&U!$k:

$RMADHOME/etc/os_aix.fmt$RMADHOME/etc/os_solaris.fmt$RMADHOME/etc/os_nt.fmt$RMADHOME/etc/os_linux.fmt$RMADHOME/etc/pix.fmt$RMADHOME/etc/pix_nt.fmt$RMADHOME/etc/rmnav.fmt$RMADHOME/etc/rmmac.fmt$RMADHOME/etc/tecad_snmp.cds$RMADHOME/etc/tecad_snmp.oid

¶ Risk Manager P<8gs 3.7 $s9H<k&79F`O"3.7 N|n9/jWHrHQ7

F|n5l^9#!K"=N|n9/jWH,o|5l^9#

Windows 79F`Nlg:

Risk Manager 3.7 r|n7F+iP<8gs 3.8 r$s9H<k9k,W,"j^9#J<

K"Risk Manager P<8gs 3.7 N"@W?<r|n9kjgr(7^9#

1. CjND- 3^sIrBT7F"|n9k"@W?<K,WJ Risk Manager NQ9r_

j7^9#qN*J3^sI>O"J<NH*jG9#

¶ %SystemRoot%¥Tivoli¥rma_eif_env.cmd

¶ %SystemRoot%¥Tivoli¥rma_web_env.cmd

¶ %SystemRoot%¥Tivoli¥rma_cpfw_env.cmd

¶ %SystemRoot%¥Tivoli¥rma_nr_env.cmd

¶ %SystemRoot%¥Tivoli¥rma_perl_env.cmd

2. |n 3^sIrBT7^9#qN*J3^sI>O"J<NH*jG9#

¶ rma_eif-remove.cmd

¶ rma_web-remove.cmd

¶ rma_cpfw-remove.cmd

¶ rma_nr-remove.cmd

¶ rma_perl-remove.cmd

3. HQ7?|n3^sIr!Nh&K7Fo|7^9#

del %RMHOME%¥bin¥%INTERP%¥bin¥Command


B.!��

��%�

33G"Command O|n9k3^sIN>0G9#

Risk Manager P<8gs 3.7 G$s9H<k5lF$?F"@W?<r|n7?eK"J<

NICN/j<s"CWrBT7^9#

1. %RMADHOME% G#l/Hj<,^@8_7F$klgO"=NG#l/Hj<H=NbFr

J<N3^sIrHQ7F|n7^9#

rmdir /s %RMADHOME%

2. TME *hS TME J0N>}KD$F"J<NU!$kr|n7^9#

del %RMHOME%¥bin¥%INTERP%¥bin¥wbindmsg.exedel %RMHOME%¥bin¥%INTERP%¥bin¥rmenvcrt.exe

3. TME J0Nlg"J<NU!$kr|n7^9#

del %RMHOME%¥msg_cat¥*¥rminst.cat

4. TME Nlg"J<NU!$kr|n7^9#

del %RMHOME%¥generic¥msg_cat¥*¥rminst.cat

P<8gs 3.8 r$s9H<k7?eGO"e-NjgrHQ7F Risk Manager P<8gs

3.7 N$s9H<k&79F`r/j<s"CW7J$G/@5$#P<8gs 3.8 N$s9

H<keKe-NjgrBT9kH"3.8 N$s9H<k&79F`,;}ru1^9#

Risk Manager Server �!��%�Risk Manager Server N"CW0l<IfK"=.U!$k, $BINDIR/RISKMGR/backup G#

l/Hj<K]I5l^9#]I5lkU!$kO"J<NH*jG9#

¶ 9YFN .pro U!$k

¶ 9YFN .lst U!$k

¶ 9YFN .rls U!$k

¶ 9YFN .baroc U!$k

¶ rmt_tasks.tll U!$k

¶ RISKMGR/ACF_REP G#l/Hj<bK"k9YFN"@W?<N=.U!$k

288 P<8gs 3 jj<9 8

Cisco Secure IDS ��3<:�

J<O"\qNPG~@GHQD=J Cisco Secure IDS $YsHNlwG9#3liO"

Cisco Secure IDS QN Risk Manager "@W?<KhCF@(*KHiCW5l":v9k"

@W?<&l3<IK^CW5l^9#

sig_1000 IP options-Bad Option List

sig_1001 IP options-Record Packet Route

sig_1002 IP options-Timestamp

sig_1003 IP options-Provide s,c,h,tcc

sig_1004 IP options-Loose Source Route

sig_1005 IP options-SATNET ID

sig_1006 IP options-Strict Source Route

sig_1100 IP Fragment Attack

sig_1101 Unknown IP Protocol

sig_1102 Impossible IP Packet

sig_1103 IP Fragments Overlap

sig_1104 IP Localhost Source Spoof

sig_1200 IP Fragmentation Buffer Full

sig_1201 IP Fragment Overlap

sig_1202 IP Fragment Overrun - Datagram Too Long

sig_1203 IP Fragment Overwrite - Data is Overwritten

sig_1204 IP Fragment Missing Initial Fragment

sig_1205 IP Fragment Too Many Datagrams

sig_1206 IP Fragment Too Small

sig_1207 IP Fragment Too Many Frags

sig_1208 IP Fragment Incomplete Datagram

sig_1220 Jolt2 Fragment Reassembly DoS attack NEW

sig_2000 ICMP Echo Reply

sig_2001 ICMP Host Unreachable

sig_2002 ICMP Source Quench

sig_2003 ICMP Redirect

sig_2004 ICMP Echo Request

sig_2005 ICMP Time Exceeded for a Datagram

sig_2006 ICMP Parameter Problem on Datagram

sig_2007 ICMP Timestamp Request

sig_2008 ICMP Timestamp Reply

sig_2009 ICMP Information Request

sig_2010 ICMP Information Reply

sig_2011 ICMP Address Mask Request

C


C.

Cisco

Secu

reID

S�

��

�3<:

�

sig_2012 ICMP Address Mask Reply

sig_2100 ICMP Network Sweep w/Echo

sig_2101 ICMP Network Sweep w/Timestamp

sig_2102 ICMP Network Sweep w/Address Mask

sig_2150 Fragmented ICMP Traffic

sig_2151 Large ICMP Traffic

sig_2152 ICMP Flood

sig_2153 Smurf

sig_2154 Ping of Death Attack

sig_3000 TCP Ports

sig_3001 TCP Port Sweep

sig_3002 TCP SYN Port Sweep

sig_3003 TCP Frag SYN Port Sweep

sig_3005 TCP FIN Port Sweep

sig_3006 TCP Frag FIN Port Sweep

sig_3010 TCP High Port Sweep

sig_3011 TCP FIN High Port Sweep

sig_3012 TCP Frag FIN High Port Sweep

sig_3015 TCP Null Port Sweep

sig_3016 TCP Frag Null Port Sweep

sig_3020 TCP SYN FIN Port Sweep

sig_3021 TCP Frag SYN FIN Port Sweep

sig_3030 TCP SYN Host Sweep

sig_3031 TCP FRAG SYN Host Sweep

sig_3032 TCP FIN Host Sweep

sig_3033 TCP FRAG FIN Host Sweep

sig_3034 TCP NULL Host Sweep

sig_3035 TCP FRAG NULL Host Sweep

sig_3036 TCP SYN FIN Host Sweep

sig_3037 TCP FRAG SYN FIN Host Sweep

sig_3038 Fragmented NULL TCP Packet

sig_3039 Fragmented Orphaned FIN packet

sig_3040 NULL TCP Packet

sig_3041 SYN/FIN Packet

sig_3042 Orphaned Fin Packet

sig_3043 Fragmented SYN/FIN Packet

sig_3045 Queso Sweep

sig_3050 Half-open SYN Attack

sig_3100 Smail Attack

sig_3101 Sendmail Invalid Recipient

sig_3102 Sendmail Invalid Sender

sig_3103 Sendmail Reconnaissance

sig_3104 Archaic Sendmail Attacks

sig_3105 Sendmail Decode Alias

sig_3106 Mail Spam

sig_3107 Majordomo Execute Attack

sig_3108 MIME Overflow Bug

sig_3109 Q-Mail Length Crash

290 P<8gs 3 jj<9 8

sig_3110 Suspicious Mail Attachment

sig_3150 FTP Remote Command Execution

sig_3151 FTP SYST Command Attempt

sig_3152 FTP CWD xroot

sig_3153 FTP Improper Address Specified

sig_3154 FTP Improper Port Specified

sig_3155 FTP RETR Pipe Filename Command Execution

sig_3156 FTP STOR Pipe Filename Command Execution

sig_3157 FTP PASV Port Spoof

sig_3200 WWW Phf Attack

sig_3201 WWW General cgi-bin Attack

sig_3202 WWW .url File Requested

sig_3203 WWW .lnk File Requested

sig_3204 WWW .bat File Requested

sig_3205 HTML File Has .url Link

sig_3206 HTML File Has .lnk Link

sig_3207 HTML File Has .bat Link

sig_3208 WWW campas Attack

sig_3209 WWW Glimpse Server Attack

sig_3210 WWW IIS View Source Attack

sig_3211 WWW IIS Hex View Source Attack

sig_3212 WWW NPH-TEST-CGI Attack

sig_3213 WWW TEST-CGI Attack

sig_3214 IIS DOT DOT VIEW Attack

sig_3215 IIS DOT DOT EXECUTE Attack

sig_3216 IIS Dot Dot Crash Attack

sig_3217 WWW php View File Attack

sig_3218 WWW SGI Wrap Attack

sig_3219 WWW PHP Buffer Overflow

sig_3220 IIS Long URL Crash Bug

sig_3221 WWW cgi-viewsource Attack

sig_3222 WWW PHP Log Scripts Read Attack

sig_3223 WWW IRIX cgi-handler Attack

sig_3224 HTTP WebGais

sig_3225 HTTP Gais Websendmail

sig_3226 WWW Webdist Bug

sig_3227 WWW Htmlscript Bug

sig_3228 WWW Performer Bug

sig_3229 Website Win-C-Sample Buffer Overflow

sig_3230 Website Uploader

sig_3231 Novell convert

sig_3232 WWW finger attempt

sig_3233 WWW count-cgi Overflow

sig_3250 TCP Hijack

sig_3251 TCP Hijacking Simplex Mode

sig_3300 NetBIOS OOB Data

sig_3301 NETBIOS Stat

sig_3302 NETBIOS Session Setup Failure


C.

Cisco

Secu

reID

S�

��

�3<:

�

sig_3303 Windows Guest Login

sig_3304 Windows Null Account Name

sig_3305 Windows Password File Access

sig_3306 Windows Registry Access

sig_3307 Windows Redbutton Attack

sig_3308 Windows LSARPC Access

sig_3309 Windows SRVSVC Access

sig_3400 Sunkill

sig_3401 Telnet-IFS Match

sig_3450 Finger Bomb

sig_3500 Rlogin -froot Attack

sig_3525 IMAP Authenticate Buffer Overflow

sig_3526 Imap Login Buffer Overflow

sig_3530 Cisco Secure ACS Oversized TACACS+ Attack NEW

sig_3540 Cisco Secure ACS CSAdmin Attack NEW

sig_3550 POP Buffer Overflow

sig_3575 INN Buffer Overflow

sig_3576 INN Control Message Exploit

sig_3600 IOS Telnet Buffer Overflow

sig_3601 IOS Command History Exploit

sig_3602 Cisco IOS Identity

sig_3603 IOS Enable Bypass

sig_3650 SSH RSAREF2 Buffer Overflow

sig_3990 BackOrifice BO2K TCP Non Stealth

sig_3991 BackOrifice BO2K TCP Stealth 1

sig_3992 BackOrifice BO2K TCP Stealth 2

sig_4000 UDP Packet

sig_4001 UDP Port Sweep

sig_4002 UDP Flood

sig_4050 UDP Bomb

sig_4051 Snork

sig_4052 Chargen DoS

sig_4053 Back Orifice

sig_4054 RIP Trace

sig_4055 BackOrifice BO2K UDP

sig_4100 Tftp Passwd File

sig_4150 Ascend Denial of Service

sig_4500 Cisco IOS Embedded SNMP Community Names NEW

sig_4600 IOS UDP Bomb

sig_5034 WWW IIS newdsn attack

sig_5035 HTTP cgi HylaFAX Faxsurvey

sig_5036 WWW Windows Password File Access Attempt

sig_5037 WWW SGI MachineInfo Attack

sig_5038 WWW wwwsql file read Bug

sig_5039 WWW finger attempt

sig_5040 WWW Perl Interpreter Attack

sig_5041 WWW anyform attack

sig_5042 WWW CGI Valid Shell Access

292 P<8gs 3 jj<9 8

sig_5043 WWW Cold Fusion Attack

sig_5044 WWW Webcom.se Guestbook attack

sig_5045 WWW xterm display attack

sig_5046 WWW dumpenv.pl recon

sig_5047 WWW Server Side Include POST attack

sig_5048 WWW IIS BAT EXE attack

sig_5049 WWW IIS showcode.asp access

sig_5050 WWW IIS .htr Overflow Attack

sig_5051 IIS Double Byte Code Page

sig_5052 FrontPage Extensions PWD Open Attempt

sig_5053 FrontPage _vti_bin Directory List Attempt

sig_5054 WWWBoard Password

sig_5055 HTTP Basic Authentication Overflow

sig_5056 WWW Cisco IOS %% DoS

sig_5057 WWW Sambar Samples

sig_5058 WWW info2www Attack

sig_5059 WWW Alibaba Attack

sig_5060 WWW Excite AT-generate.cgi Access

sig_5061 WWW catalog_type.asp Access

sig_5062 WWW classifieds.cgi Attack

sig_5063 WWW dmblparser.exe Access

sig_5064 WWW imagemap.cgi Attack

sig_5065 WWW IRIX infosrch.cgi Attack

sig_5066 WWW man.sh Access

sig_5067 WWW plusmail Attack

sig_5068 WWW formmail.pl Access

sig_5069 WWW whois_raw.cgi Attack

sig_5070 WWW msadcs.dll Access

sig_5071 WWW msacds.dll Attack

sig_5072 WWW bizdb1-search.cgi Attack

sig_5073 WWW EZshopper loadpage.cgi Attack

sig_5074 WWW EZshopper search.cgi Attack

sig_5075 WWW IIS Virtualized UNC Bug

sig_5076 WWW webplus bug

sig_5077 WWW Excite AT-admin.cgi Access

sig_5078 WWW Piranha passwd attack

sig_5079 WWW PCCS MySQL Admin Access

sig_5080 WWW IBM WebSphere Access NEW

sig_5081 WWW WinNT cmd.exe Access NEW

sig_5083 WWW Virtual Vision FTP Browser Access NEW

sig_5084 WWW Alibaba Attack 2 NEW

sig_5085 WWW IIS Source Fragment Access NEW

sig_5086 WWW WEBactive Logfile Access NEW

sig_5087 WWW Sun Java Server Access NEW

sig_5088 WWW Akopia MiniVend Access NEW

sig_5089 WWW Big Brother Directory Access NEW

sig_5090 WWW FrontPage htimage.exe Access NEW

sig_5091 WWW Cart32 Remote Admin Access NEW


C.

Cisco

Secu

reID

S�

��

�3<:

�

sig_5092 WWW CGI-World Poll It Access NEW

sig_5093 WWW PHP-Nuke admin.php3 Access NEW

sig_5095 WWW CGI Script Center Account Manager Attack NEW

sig_5096 WWW CGI Script Center Subscribe Me Attack NEW

sig_5097 WWW FrontPage MS-DOS Device Attack NEW

sig_5099 WWW GWScripts News Publisher Access NEW

sig_5100 WWW CGI Center Auction Weaver File Access NEW

sig_5101 WWW CGI Center Auction Weaver Attack NEW

sig_5102 WWW phpPhotoAlbum explorer.php Access NEW

sig_5103 WWW SuSE Apache CGI Source Access NEW

sig_5104 WWW YaBB File Access NEW

sig_5105 WWW Ranson Johnson mailto.cgi Attack NEW

sig_5106 WWW Ranson Johnson mailform.pl Access NEW

sig_5107 WWW Mandrake Linux /perl Access NEW

sig_5108 WWW Netegrity Site Minder Access NEW

sig_5109 WWW Sambar Beta search.dll Access NEW

sig_5110 WWW SuSE Installed Packages Access NEW

sig_5111 WWW Solaris Answerbook 2 Access NEW

sig_5112 WWW Solaris Answerbook 2 Attack NEW

sig_5113 WWW CommuniGate Pro Access NEW

sig_5114 WWW IIS Unicode Attack NEW

sig_6001 Normal SATAN Probe

sig_6002 Heavy SATAN Probe

sig_6050 DNS HINFO Request

sig_6051 DNS Zone Transfer

sig_6052 DNS Zone Transfer from High Port

sig_6053 DNS Request for All Records

sig_6054 DNS Version Request

sig_6055 DNS Inverse Query Buffer Overflow

sig_6056 BIND NXT Buffer Overflow

sig_6057 BIND SIG Buffer Overflow

sig_6100 RPC Port Registration

sig_6101 RPC Port Unregistration

sig_6102 RPC Dump

sig_6103 Proxied RPC Request

sig_6104 RPC Set Spoof

sig_6105 RPC Unset Spoof

sig_6110 RPC RSTATD Sweep

sig_6111 RPC RUSERSD Sweep

sig_6112 RPC NFS Sweep

sig_6113 RPC MOUNTD Sweep

sig_6114 RPC YPPASSWDD Sweep

sig_6115 RPC SELECTION_SVC Sweep

sig_6116 RPC REXD Sweep

sig_6117 RPC STATUS Sweep

sig_6118 RPC ttdb Sweep

sig_6150 ypserv Portmap Request

sig_6151 ypbind Portmap Request

294 P<8gs 3 jj<9 8

sig_6152 yppasswdd Portmap Request

sig_6153 ypupdated Portmap Request

sig_6154 ypxfrd Portmap Request

sig_6155 mountd Portmap Request

sig_6175 rexd Portmap Request

sig_6180 rexd Attempt

sig_6190 statd Buffer Overflow

sig_6191 RPC.tooltalk buffer overflow

sig_6192 RPC mountd Buffer Overflow

sig_6193 RPC CMSD Buffer Overflow

sig_6194 sadmind RPC Buffer Overflow

sig_6195 RPC amd Buffer Overflow

sig_6200 Ident Buffer Overflow

sig_6201 Ident Newline

sig_6202 Ident Improper Request

sig_6250 FTP Authorization Failure

sig_6251 Telnet Authorization Failure

sig_6252 Rlogin Authorization Failure

sig_6253 POP3 Authorization Failure

sig_6255 SMB Authorization Failure

sig_6300 Loki ICMP Tunnelling

sig_6302 General Loki ICMP Tunneling

sig_6500 RingZero Trojan

sig_6501 TFN Client Request

sig_6502 TFN Server Reply

sig_6503 Stacheldraht Client Request

sig_6504 Stacheldraht Server Reply

sig_6505 Trinoo Client Request

sig_6506 Trinoo Server Reply

sig_6507 TFN2K Control Traffic

sig_6508 Mstream Control Traffic

sig_8000/2101 FTP Retrieve Password File

sig_8000/2302 Telnet-/etc/shadow Match

sig_8000/2303 Telnet-+ +

sig_8000/51301 Rlogin-IFS Match

sig_8000/51302 Rlogin-/etc/shadow Match

sig_8000/51303 Rlogin-+ +

sig_10000/1000 IP-Spoof Interface 1

sig_10000/1001 IP-Spoof Interface 2


C.

Cisco

Secu

reID

S�

��

�3<:

�

296 P<8gs 3 jj<9 8

ISS RealSecure ��3<:�

J<Nj9HO"=~@G ISS RealSecure Khj SNMP $YsHH7F TEC SNMP "@

W?<Kw.5lk6br(7^9#3li,"=_ TEC SNMP "@W?<KhCF5]<

H5lF$k6b70KAc<G9#

Risk Manager ,5]<H7J$ ISS RealSecure 6bO9YF Catch All /i9K,`5l

^9#

(+4��3<:�HTTP..

HTTP Robots Txt

HTTP NCSA Buffer Overflow

HTTP NT8.3 Filename

HTTP Netscape Space View

HTTP Netscape Page Services

HTTP IE3 URL

HTTP IIS$DATA

HTTP PHF

HTTP UNIX Passwords

HTTP IE BAT

HTTP Nph Test Cgi

HTTP Shells

HTTP Test Cgi

HTTP WebSite Uploader

HTTP Sgi Handler

HTTP WebSite Sample

HTTP IISExAir DoS

HTTP Campas cgi-bin

HTTP HylaFax faxsurvey

HTTP Cold Fusion

HTTP IIS3 Asp Dot

HTTP IIS3 Asp 2e

HTTP WebFinger

HTTP Cachemgr

HTTP MachineInfo

HTTP Count

HTTP SiteCsc Access

HTTP Webgais

D


D.

ISS

RealS

ecure

��

3<:

�

HTTP FormMail

HTTP Guestbook

HTTP Websendmail

HTTP Classifieds Post

HTTP Glimpse cgi-bin

HTTP HTMLScript

HTTP Novell Convert

HTTP Novell Files

HTTP PHP Overflow

HTTP Pfdisplay Read

HTTP Pfdisplay Execute

HTTP RegEcho

HTTP RpcNLog

HTTP SCO View-Source

HTTP SGI Wrap

HTTP SGI Webdist

HTTP Verity Search

HTTP Carbo Server

HTTP Info2WWW

HTTP JJ

HTTP Cdomain

ARP Host Down

Portmapper Program Dump Decode

IP HalfScan

Queso Scan

Rlogin -froot

Windows Access Error

Ftp SYST Command Decode

Ftp Root

FSP Detected

Finger User

Port Scan

UDP Port Scan

Kerberos User Snarf

DNS Length Overflow

Echo Denial of Service

Generic Intel Overflow

Mountd Export Decode

Mountd Mnt Decode

Nfs Mknod Check

Perl Fingerd Check

Email Expn

Email Vrfy

Email Vrfy Overflow

Email Helo Overflow

Email Ehlo

Email Pipe

Email Decode

298 P<8gs 3 jj<9 8

Email Debug

Email Wiz

Email Qmail Length

Ident Error

Snmp Activity

Snmp Set

Sun SNMP Backdoor

HP OpenView SNMP Backdoor

Imap User

Imap Password

Imap Overflow

POP Overflow

TearDrop

Land_UDP

Land Denial of Service Attack

Ident User Decoding

Finger Bomb

FTP Bounce

FTP Privileged Bounce Attack

Ping Flood

Smurf

Win IGMP

Windows Out Of Band

Ping Of Death

SYNFlood

IP Protocol Violation

BackOrifice

TrinooDaemon

NetBus_Pro

IPUnknownProtocol

IPFrag

Satan

ISS Scan Check

��3<:�Login Successful

Logout

Guest

Use Of User Rights

Password change Failed

Password change Successful

Failed login - account locked out

Failed login - account expired

Failed login - bad username or password

Failed login - account disabled

Logon with Admin Privileges

Global group user added


D.

ISS

RealS

ecure

��

3<:

�

Global group user removed

Local group changed

Local group created

Local group deleted

Local group user added

Local group user removed

Account policy change

User account changed

User account created

User account deleted

User right granted

User right revoked

Audit log cleared

Audit policy change

User added to local admin group

User admin right granted

Important programs

Privilege service called

Registry autorun changed

Program started

Program exited

Logon process registered

Brute Force login attack

Brute Force login attack Successful

Change password attack

Change password attack Successful

Registry eventlog settings changed

Registry NT security options changed

Failed change of important files

Config-log files deleted

Suspect port scan

Suspicious FTP connection

Suspicious IMAP connection

Suspicious Netstat connection

Suspicious POP3 connection

Suspicious POP2 connection

Suspicious SMTP connection

Suspicious Systat connection

Suspicious Telnet connection

Suspicious Whois connection

Suspicious WWW connection

Suspicious Finger connection

Suspicious Time connection

Suspicious SSH connection

Suspicious Sunrcp connection

Suspect Netbus

300 P<8gs 3 jj<9 8

McAfee Alert Manager �� McAfeeNetShield �*��$+&�0

J<N McAfee Alert Manager *hS NetShield aC;<8O"Risk Manager rmmac.fmt U

)<^CH&U!$kKhjhj~^l^9#

[HsINaC;<8O"Alert Manager $YsH&m0&"i<H G+O7^9#

¶ EgaC;<8:

v U!$k %FILENAME% , %VIRUSNAME% %VIRUSTYPE% K6w7F$^9#9

-cs&(s8s %ENGINEVERSION% DAT P<8gs %DATVERSION% Khk

!PG9#

v U!$k %FILENAME% , %VIRUSNAME% %VIRUSTYPE% K6w7F$^9#=

_N9-cs&(s8s&P<8gs %ENGINEVERSION% DAT P<8gs

%DATVERSION% GOU!$kN/j<Ks0OG-^;s#


wU!$kro|9k3H,G-^;s#

v J_N9-cs+i %FILENAME% r|09k3H,G-^;s#

v U!$k %FILENAME% , %VIRUSNAME% %VIRUSTYPE% K6w7F$^9#U

!$kXN"/;9,q]5l^7?#9-cs&(s8s&P<8gs

%ENGINEVERSION% DAT P<8gs %DATVERSION% Khk!PG9#


!$krV%NhK\09k3H,G-^;s#9-cs&(s8s&P<8gs


v 79F`&abj<, %VIRUSNAME% %VIRUSTYPE% K6w7F$^9#9-c

s&(s8s&P<8gs %ENGINEVERSION% DAT P<8gs %DATVERSION%

Khk!PG9#

v V<H&l3<I, %VIRUSNAME% %VIRUSTYPE% K6w7F$^9#9-c

s&(s8s&P<8gs %ENGINEVERSION% DAT P<8gs %DATVERSION%

Khk!PG9#

v 6wU!$k,!P5l^7?#9-cs&(s8s&P<8gs

%ENGINEVERSION% DAT P<8gs %DATVERSION%#9-cs&(s8s&P

<8gs %ENGINEVERSION% DAT P<8gs %DATVERSION% Khj6wU!

$k,!P5l"/j<Ks05l^7?#

v P$s@<&*V8'/H,6w7F$^9#

E


E.

McA

fee�*

�

�$+&

�0

v U!$k %FILENAME% , %VIRUSNAME% %VIRUSTYPE% K6w7F$^9#

Heuristics"9-cs&(s8s %ENGINEVERSION% DAT P<8gs

%DATVERSION% Khk!PG9#

v Heuristics KhjU!$k %FILENAME% N %VIRUSNAME% %VIRUSTYPE% 6w

,!P5l^7?#6wU!$kro|9k3H,G-^;s#


,!P5l"U!$k,V%NhK\05l^7?#9-cs&(s8s&P<8gs



,!P5l^7?#U!$krV%NhK\09k3H,G-^;s#9-cs&(s

8s&P<8gs %ENGINEVERSION% DAT P<8gs %DATVERSION% Khk

!PG9#

v %VIRUSNAME% %VIRUSTYPE% K6w7?V<H&l3<IN/j<Ks0fK(

i<,/87^7?#9-cs&(s8s&P<8gs %ENGINEVERSION% DAT

P<8gs %DATVERSION% Khk!PG9#

v %MAILFROMNAME% +i %MAILTONAME% "FNERa<k (o>

%MAILSUBJECTLINE%) N:UU!$k %FILENAME% , %VIRUSNAME% K6w

7F$^9#6w7?:UU!$kO"9-cs&(s8s&P<8gs

%ENGINEVERSION% DAT P<8gs %DATVERSION% GO/j<Ks0G-^;

s#U!$kOo|5l^7?#

v %MAILFROMNAME% +i %MAILTONAME% "FNERa<k (CC:

%MAILCCNAME%"o> %MAILSUBJECTLINE%) ,&#k9 %VIRUSNAME% K6

w7F$^9#ERa<kOo|5l^7?#



7F$^9#6w7?:UU!$kO"9-cs&(s8s&P<8gs

%ENGINEVERSION% DAT P<8gs %DATVERSION% GO/j<Ks0G-^;

s#U!$kOo|5lV%5l^7?#

¶ a8c<&aC;<8:


-cs&(s8s&P<8gs %ENGINEVERSION% DAT P<8gs

%DATVERSION% KhjU!$kN/j<Ks0,5oKTol^7?#


!$kO5oKo|5l^7?#


,!P5l^7?#U!$kO5oKo|5l^7?#

v 97K:T7^7?#$YsH&m0r2H7F/@5$#

v "CW0l<IK:T7^7?#$YsH&m0r2H7F/@5$#



w7F$^9#

v GgiYro,/87F$^9#

302 P<8gs 3 jj<9 8

¶ ^$J<&aC;<8:

v %FILENAME% bG^/m,!P5l^7?#

v %FILENAME% +i^/m,o|5l^7?#



7F$^9#6w7?:UU!$k,/j<Ks05l^7?#



w7F$^9#ERa<k,V%5l^7?#

v G#9/&9Z<9Ku-,G-k^Ge.ERa<kO]15l^9#

v Yp - [o*;#



7F$^9#6w7?:UU!$k,/j<Ks05lV%5l^7?#

¶ YpaC;<8:

v J_N9-cs+iU!$k %FILENAME% ,|05l^9#


wU!$kOV%NhK\05l^7?#9-cs&(s8s&P<8gs

%SCANENGINE% DAT P<8gs %DATVERSION% Khk!PG9#

v 9-cs,-cs;k5l^7?#%GMTTIME%

v U!$k %FILENAME% N9-csfK""/F#SF#<&m0&U!$kXN"

/;9G(i<,sp5l^7?#9-cs&(s8s&P<8gsO"

%ENGINEVERSION% DAT P<8gs %DATVERSION% G9#

v U!$k %FILENAME% N9-csfK"abj<dj6j(i<,sp5l^7

?#9-cs&(s8s&P<8gsO"%ENGINEVERSION% DAT P<8gs

%DATVERSION% G9#

v G#l/Hj<&Q9>,99.^9#Xj5l?LVG9-csG-J$`\,"j

^9#U!$k %FILENAME% N9-csfK(i<,/87^7?#9-cs&(

s8s&P<8gsO"%ENGINEVERSION% DAT P<8gs %DATVERSION% G

9#

v U!$k %FILENAME% r9-csfK"q-~_]nN?aaG#"K"/;9G

-^;sG7?#9-cs&(s8s&P<8gsO"%ENGINEVERSION% DAT P

<8gs %DATVERSION% G9#

v U!$k %FILENAME% r9-csfK"Xj5l?aG#",+U+j^;sG7

?#9-cs&(s8s&P<8gsO"%ENGINEVERSION% DAT P<8gs

%DATVERSION% G9#

v U!$k %FILENAME% N9-csfK"5zJ9-cs`\,!P5l^7?#9

-cs&(s8s&P<8gsO"%ENGINEVERSION% DAT P<8gs

%DATVERSION% G9#


E.

McA

fee�*

�

�$+&

�0

v U!$k %FILENAME% N9-csfK"U!$k~PO(i<,sp5l^7?#

9-cs&(s8s&P<8gsO"%ENGINEVERSION% DAT P<8gs

%DATVERSION% G9#

v U!$k %FILENAME% N9-csfK"G#9/~PO(i<,sp5l^7?#


%DATVERSION% G9#

v U!$k %FILENAME% N9-csfK"lL79F`&(i<,sp5l^7?#


%DATVERSION% G9#

v U!$k %FILENAME% N9-csfK"bt"Wj1<7gs&(i<,sp5l

^7?#9-cs&(s8s&P<8gsO"%ENGINEVERSION% DAT P<8gs

%DATVERSION% G9#

v Q9o<I]nU!$k %FILENAME% Nh}fK(i<,!P5l^7?#9-c

s&(s8s&P<8gsO"%ENGINEVERSION% DAT P<8gs

%DATVERSION% G9#

v Q9o<I]nU!$k %FILENAME% N9-csrT(^;s#9-cs&(s8

s&P<8gsO"%ENGINEVERSION% DAT P<8gs %DATVERSION% G9#

v %FILENAME% N9-csK~V,++j9.k?a-cs;k5l^7?#9-c

s&(s8s&P<8gsO"%ENGINEVERSION% DAT P<8gs

%DATVERSION% G9#

v %VIRUSNAME% %VIRUSTYPE% K6w7?V<H&l3<Ir/j<Ks07^7

?#9-cs&(s8s&P<8gs %ENGINEVERSION% DAT P<8gs

%DATVERSION% Khk!PG9#

v "i<HNw.fK(i<,/87^7?#

v Xj5l?*W7gs,5zG9#

v 918e<k&?9/r+OG-^;s#

v (i<Khj918e<k&?9/,d_7^7?#

v ?9/,-cs;k5l^7?#

v m0&U!$k %FILENAME% XNq-~_fK(i<,/87^7?#

v abj<dj6j(i<,/87^7?#

v 9-csh}(i<#

v "CW0l<I,-cs;k5l^7?#

v E$ DAT P<8gsrHQ7F$^9#9-cs&P<8gs

%ENGINEVERSION% DAT P<8gs %DATVERSION%#


%MAILSUBJECTLINE%) Khk3sFsD&U#k?<&k<k %VIRUSNAME% c

?G9#ERa<k,VmC/5lF$^9#


%MAILCCNAME%"o> %MAILSUBJECTLINE%) Khk3sFsD&U#k?<&

k<kc?G9#ERa<k,VmC/5lF$^9#

304 P<8gs 3 jj<9 8

v G#9/&9Z<9Ku-,G-??a"e.ERa<kNu.,F+7^7?#

¶ LNaC;<8:

v 9-cs,0;7^7?#6wU!$kO!P5l^;sG7?#9-cs&(s8

s&P<8gsO"%ENGINEVERSION% DAT P<8gs %DATVERSION% G9#

v 5<S9,+O7^7?#

v 5<S9,*;7^7?#

v ?9/,5oK+O7^7?#

v 918e<k&?9/,d_7^7?#

v ?9/,5oKTol^7?#

v *s&"/;9&9-cs,+O7^7?#%GMTTIME%#9-cs&P<8gs


v *s&"/;9&9-cs,d_7^7?#9-cs&P<8gs


v 9-cs_j %INFO#9-cs&P<8gs %ENGINEVERSION% DAT P<8gs

%DATVERSION%#

v EVENT_SCAN_ENDED

v 97,5oKTol^7?#9-cs&P<8gs %ENGINEVERSION% DAT P<

8gs %DATVERSION%#

v 97,BTfG9#

v 97,-cs;k5l^7?#

v "CW0l<I,BTfG9#

v DAT U!$kN+097Khj"9-cs,-cs;k5l^7?#9-cs&P<

8gs %ENGINEVERSION% DAT P<8gs %DATVERSION%#

v Wm;9,+O7^7?#

v Wm;9,*;7^7?#

v *sG^sI&9-cs,+O7^7?#

v *sG^sI&9-cs,0;7^7?#!P&#k9 %NUMVIRS%"/j<Ks0

%NUMCLEANED%"o| %NUMDELETED%"V% %NUMQUARANTINED%#

9-cs&P<8gs %ENGINEVERSION% DAT P<8gs %DATVERSION%#

v %OS% GBTf#Wm;C5<&7j"kVf %PROCESSORSERIAL% (PIII N_)#

v O0Wa,5oKh}5l^7?#

v 7cCH@&sWa,5oKh}5l^7?#

v %FILENAME% G7, MIB U!$k,HQD=G9#

v Alert Manager 5<S9: Alert Manager 5<S9,+O7^7?#

v Network Associates AutoUpdate ,5oK+O7^7?#

v Network Associates AutoUpdate ,5oKd_7^7?#


E.

McA

fee�*

�

�$+&

�0

v 7,P<8gsO"$s9H<kQ_N=JP<8gsH18G9#

v DAT U!$kN %DATVERSION% P<8gsK97fG9#

v NetShield 2000 McShield 5<S9,+O7^7?#%NUMVIRS% &#k9r9-cs

fG9#(s8s&P<8gs: %ENGINEVERSION%"Ii$P<&P<8gs:

%DATVERSION%"(/9Hi&Ii$P<>: %DRIVERNAME%"(/9Hi&Ii

$P<N&#k9&70KAc<Vft: %NUM%"(/9Hi&Ii$P<,!PD

=J&#k9>: %VIRUSNAMES%

306 P<8gs 3 jj<9 8

Network IDS ��3<:�

Network Intrusion Detection System (IDS) O"ID VfrHQ7F6b"i<HrhL7^

9#3liNVfO"Common Vulnerability Entry (CVE) VfKOP~7F$^;s#3l

O"Network IDS OHe-J0N;-ejF#<dj (=.(i<"PC/&I""9-cs

Ks0JI) rF9H9k?aG9#^?"Network IDS O6brG-k@1FQ-N"kA

G'17h&H7^9# CVE (sHj<K5NKP~9k Network IDS 70KAc<KD

$F Network IDS GO"l]<H&9Hjs0Nh,K CVE 2H ID ,U$F$^9#G

-N CVE ID KX9kpsO"http://csrc.nist.gov/icat/vulnerabilities/<CVE-ID> +i~j9k3

H,G-^9#

Network IDS OEgYlYkr0tMH7FXj7^9#<m (0) Oj9/NEg-,c$


"i<HO"=l>l"i<Hr+F4j<=9k-<o<IG+O5l^9#"i<HN+

F4j<O!NH*jG9#

= 19. "i<HN+F4j<

CVE CVE G<?Y<9Kj9H5lkG-NHe-

ALERT CVE G<?Y<9Kj9H5lF$J$FQN6b

DOS {NN5<S9826b

SCAN 6b0N4:r(9HiU#C/&Q?<s

CONFIG ;-ejF#<X"N=.(i<rHQ7h&H9kn_

AUTH 6br(9D=-,"k'ZN:T

BACKDOOR {NNPC/&I"&Wm0i`VHNHiU#C/

STEALTH {NN9Fk96bKD$FlL*JHiU#C/

Network IDS GO"H_~_"i<HH70KAc<&Y<9N 2 DN+F4j<N!P,

Tol^9#

Network IDS �%%�*�H_~_"i<HO";C7gs^?OQ1CH&G<?K*1k1cJQ?<sN!PKh

CF!PG-J$u7r7$^9#3liNu7r!P9kKO"WmH3kbNPCr4Y

k+"#tN;C7gsVG,OrT$^9# Network IDS KO3liNF9H,O<I3

<G#s05lF*j"3lOQ99k3H,G-^;s# Network IDS O"3liNH_

~_"i<HNPO9Hjs0*hSEgYlYkr ids.msg U!$kKXj7F$^9#

F


F.

Netw

ork

IDS

��3<

:�

J<O"\qNPG~@GHQD=J Network IDS H_~_"i<H&$YsHNlwG

9#3liN$YsHO"Risk Manager Network IDS "@W?<KhCF@(*KHiCW

5l":v9k UNIX syslog $YsH&m0&l3<IK^CW5l^9#

��CVE-1999-0526 AUTH X11 client connected with NULL auth

N/A AUTH - BAD PASSWORD

N/A AUTH - LOGIN FAILURE

N/A AUTH - UNKNOWN USER

N/A AUTH - X11-Connection failed

�+��N/A BACKDOOR - Possible Back Orifice session detected

��CVE-1999-0986 CONFIG - Record Route Packet

N/A CONFIG - Source Routed Packet

��-��CVE-1999-0016 DOS - SRC address is equal to DST address

CVE-1999-0103 DOS - UDP FLOOD

CVE-1999-0116 DOS - SYN FLOOD

CVE-1999-0128 DOS - Oversized Pa

CVE-1999-016 DOS - IPFRAG overlay - possible teardrop

CVE-1999-0153 DOS - OUT-OF-BAND Data.. possible WINNUKE

CVE-1999-0513 DOS - ICMP Flood

N/A DOS - FIN FLOOD

N/A DOS - IP Fragment Length <= 0 - possible DOS

N/A DOS - Possible connection flood

N/A DOS - RST FLOOD

LOKIN/A BACKDOOR - LOKI packet - 2 way stealth channel

308 P<8gs 3 jj<9 8

�N/A SCAN - ICMP - Wide Scan Fast

N/A SCAN - TCP - FIN Scan Slow

N/A SCAN - TCP - FIN Scan

N/A SCAN - TCP - Port Scan Fast

N/A SCAN - TCP - Port Scan Slow

N/A SCAN - TCP - RST Scan Slow

N/A SCAN - TCP - RST Scan

N/A SCAN - TCP - Wide Scan Fast

N/A SCAN - UDP - Port Scan Fast

N/A SCAN - UDP - Port Scan Slow

N/A SCAN - UDP - Wide Scan Fast

N/A SCAN - UDP - Wide Scan Slow

��CVE-2000-0305 STEALTH - Possible IP Frag attack

N/A STEALTH - FRAGMENTED packet in session

N/A STEALTH - Micro Frag detected - possible IDS evasion

N/A STEALTH - Time-To-Live: Changed - possible IDS evasion

��3<:��*�70KAc<&Y<9N"i<HNlg" Network IDS OjjNWmH3k&lYkK*1

kQ1CH^?O;C7gs&G<?&9Hj<`bNXjQ?<sr!P7^9# Network

IDS O"3li70KAc<NQ?<s""i<HN%hgL"*hSPOaC;<8r

ids.rules U!$kKXj7F$^9#J<O"\qNPG~@GHQD=J Network IDS $

YsHNlwG9#3liO Network IDS Khj@(*KHiCW5l":v9k UNIX

syslog $YsH&m0&l3<IK^CW5l^9#?$W"WmH3k"*hSaC;<8

A0Gpsr(7^9#

��*�

DNSCVE-1999-0166 ALERT Bad request ../.. possible attack

N/A ALERT Attempt to crash mSQL server


F.

Netw

ork

IDS

��3<

:�

N/A ALERT Bad request /bin/ possible attack

N/A ALERT DNS - Encrypted DATA

N/A ALERT Intel NOOP codes..Possible Buffer Overflow

N/A ALERT RS6K NOOP codes..Possible Buffer Overflow

N/A ALERT SPARC NOOP codes..Possible Buffer Overflow

N/A ALERT Slammer attack

N/A ALERT create file foo

N/A ALERT iChat Server vulnerability

N/A ALERT write file: .rhosts - data: +

FTPCVE-1999-0080 ALERT site exec bug

CVE-1999-0080 SITE ALERT command

CVE-1999-0095 ALERT DEBUG command attempted

CVE-1999-0095 ALERT Sendmail DEB

CVE-1999-0095 ALERT WIZ command attempted

CVE-1999-0166 ALERT ../.. file attempt


N/A ALERT Mail Relay Attempted

N/A ALERT Mail being sent to file

N/A ALERT PIPE - bug 2

N/A ALERT PIPE - bug 3

N/A ALERT PIPE - bug


N/A ALERT SMTP help invoked


N/A ALERT access .rhost or .forward file

N/A ALERT access hosts.equiv file

310 P<8gs 3 jj<9 8

N/A ALERT cannot mail directly to programs

N/A ALERT mail being sent to program

N/A ALERT mail being sent to system

N/A ALERT old sendmail version

N/A APPE (Append) command attempted

N/A Permission Denied Notice

N/A Unsafe CHMOD attempted

IDENTN/A ALERT possible IDENT attack

IMAPN/A ALERT Intel NOOP codes..Possible Buffer Overflow



N/A ALERT possible exploit attempt IMAP

IPN/A ALERT ICMP - Duplicate SEQ number

N/A ALERT ICMP - Encrypted PAYLOAD

N/A POLICY - Possible spoofed IP address

NNTPN/A ALERT NNTP signature

N/A ALERT shell command in news ctrl msg

POPN/A ALERT Intel NOOP codes..Possible Buffer Overflow



N/A ALERT possible exploit attempt POP

TelnetCVE-1999-0067 ALERT attack - PHF bug

CVE-1999-0067 ALERT attack - known phf bug


F.

Netw

ork

IDS

��3<

:�

CVE-1999-0277 ALERT linux workman exploit

N/A ALERT expn - known sendmail problem

N/A ALERT possible AIX lquerypv exploit

N/A ALERT possible attack - gene

N/A ALERT possible chmod sgid file

N/A ALERT possible chmod suid file

N/A ALERT possible chmod uid/sgid file

N/A ALERT sendmail pipe bug

N/A ALERT tprof -x AIX

TFTPN/A ALERT TFTP - Attempt to grab system file

WWWCVE-1999-0039 ALERT SGI webdist.cgi attack

CVE-1999-0039 ALERT SGI webdist.cgi/wrap attack

CVE-1999-0058 ALERT php.cgi access. known security exposure

CVE-1999-0067 ALERT PHF attempt

CVE-1999-0146 ALERT CAMPAS SECURITY BUG

CVE-1999-0175 ALERT Novell convert.bas vulnerability

N/A ALERT ./UnlGG1.1 vulnerability

N/A ALERT /bin/filemail.pl vulnerability

N/A ALERT /cgi-bin/bnbform.cgi vulnerability

N/A ALERT /cgi-bin/cgimail.exe vulnerability

N/A ALERT /cgi-bin/mlog.phtml vulnerability

N/A ALERT /cgi-bin/mylog.phtm vulnerability

N/A ALERT AT-admin.cgi vulnerability

N/A ALERT Attempting to retrieve access file

N/A ALERT CGI_lite.pm, know security problem

312 P<8gs 3 jj<9 8

N/A ALERT EWS (Excite for Web Servers) CGI hole

N/A ALERT Glimpse Server attack

N/A ALERT Hostile Servlet attempt

N/A ALERT IIS icat script vulnerable

N/A ALERT IIS perl script vulnerable


N/A ALERT Link to BAK file

N/A ALERT Link to LNK file

N/A ALERT Link to URL file

N/A ALERT Lotus Notes system file attempt

N/A ALERT MAN-sh Possible Vulnerable program access

N/A ALERT MS Front Page vulnerable ext

N/A ALERT MS IIS CGI filename exploit

N/A ALERT MS Index Server Source Disclosure

N/A ALERT MS Personal Web Server listing bug

N/A ALERT MS frontpage vulnerability

N/A ALERT POST proxy attempted

N/A ALERT Page Services bug attempted

N/A ALERT Possible Code Red compromise

N/A ALERT Possible Code Red worm attack

N/A ALERT Possible Counter.cgi attack


N/A ALERT SGI - Vulnerable program access

N/A ALERT SGI handler attack


N/A ALERT Showcode vulnerability attempted


F.

Netw

ork

IDS

��3<

:�

N/A ALERT Suspicious HTTP Request

N/A ALERT UNICODE

N/A ALERT Vulnerable CGI program detected

N/A ALERT Vulnerable CGI

N/A ALERT WINDOWS Teamtrack vulnerability

N/A ALERT WWW dumping system files

N/A ALERT WebGAIS Accessed - check logs

N/A ALERT WebGAIS Accessed via mail - check logs

N/A ALERT WebSite buffer Overflow

N/A ALERT Windmail vulnerability attempted

N/A ALERT accessing vulnerable script

N/A ALERT asapi/query vulnerability

N/A ALERT asapi/srch vulnerability

N/A ALERT attempt to break out of dir

N/A ALERT attempt to locate shell

N/A ALERT attempting to use date

N/A ALERT coldfusion display openfile vulnerability

N/A ALERT coldfusion exprcalc vulnerability

N/A ALERT coldfusion openfile vulnerability

N/A ALERT dumping .asp source code

N/A ALERT getmvs vulnerability

N/A ALERT htmlscript access attempt

N/A ALERT lyris vulnerability

N/A ALERT maillist.pl vulnerability

N/A ALERT proxy attempted

N/A ALERT survey.cgi vulnerability

314 P<8gs 3 jj<9 8

N/A ALERT test-cgi access. known security exposure

N/A ALERT tools/getdrvrs.exe vulnerability

N/A ALERT tools/iisamin vulnerability

N/A ALERT tools/newdsn.exe vulnerability

N/A ALERT uploader.exe access. check logs

N/A ALERT web-store.cgi vulnerability

N/A ALERT webcom guestbook vulnerability

N/A ALERT websendmail vulnerability

X11CVE-1999-0067 ALERT attack - PHF bug

CVE-1999-0067 ALERT attack - known phf bug

N/A ALERT expn - known sendmail problem

N/A ALERT linux workman exploit

N/A ALERT possible AIX lquerypv exploit

N/A ALERT possible attack - newline problem in httpd

N/A ALERT possible chmod sgid file

N/A ALERT possible chmod suid file

N/A ALERT possible chmod uid/sgid file

N/A ALERT sendmail pipe bug

N/A ALERT tprof -x AIX

XDMCPN/A ALERT Intel NOOP codes..Possible Buffer Overflow



��

DNSN/A ALERT Intel NOOP codes..Possible Buffer Overflow



F.

Netw

ork

IDS

��3<

:�


N/A ALERT Spawning ROOT shell

N/A ALERT write file foobar

N/A AUTH NULL or Bad Password

N/A AUTH Null or Bad user name

FTPN/A ALERT attempt to go to root directory

N/A AUTH Anon FTP login

N/A AUTH BOGUS login

N/A AUTH attempt to login as demos

N/A AUTH attempt to login as lp

N/A AUTH attempt to login as sync

N/A AUTH guest login banner

N/A AUTH guest login

N/A AUTH root login offpeak

POPN/A AUTH POP login failure

TelnetN/A ALERT rlogin -froot bug

N/A AUTH AS/400 Default accounts attempted

N/A AUTH DEC server default accounts attempted

N/A AUTH DEFAULT USER Account access attempted

N/A AUTH ROOT logging in

N/A AUTH ROOTKIT Default password

N/A AUTH login failure

N/A AUTH permission warning

316 P<8gs 3 jj<9 8

TFTPN/A ALERT TFTP - Attempt to grab password file

N/A ALERT TFTP - password file contents in TFTP session

N/A ALERT TFTP - router password file in TFTP session

WWWN/A ALERT attempt to access password file

X11N/A ALERT rlogin -froot bug

N/A AUTH login failure

N/A AUTH permission warning

�+��

DNSN/A BACKDOOR Back Orifice

N/A BACKDOOR Common Backdoor port

N/A BACKDOOR Deep Throat port

N/A BACKDOOR Deep Throat traffic

N/A BACKDOOR NetBus getinfo request

N/A BACKDOOR NetBus port

N/A BACKDOOR NetBus traffic

N/A BACKDOOR PC Anywhere port access

��

DNSN/A CONFIG 3270 mapper - service

N/A CONFIG ALIS - service

N/A CONFIG DATABASE_SVC - service

N/A CONFIG ETHERSTATD - service

N/A CONFIG KEYSERVD - service

N/A CONFIG LLOCKMGR - service

N/A CONFIG NLOCKMGR - service


F.

Netw

ork

IDS

��3<

:�

N/A CONFIG NSEMNTD - service

N/A CONFIG PCNFS - BAD SERVICE

N/A CONFIG REXD - vulnerable service

N/A CONFIG RJE MAPPER - service running

N/A CONFIG RQUOTAD - service

N/A CONFIG RSED - service

N/A CONFIG RSTATD - service

N/A CONFIG RUSERS - service

N/A CONFIG RWALLD - vulnerable service

N/A CONFIG SELECTION SVC - vulnerable service

N/A CONFIG SHOWFHD - vulnerable service

N/A CONFIG SNMP - service

N/A CONFIG SPRAYD - vulnerable service

N/A CONFIG STAT - vulnerable service

N/A CONFIG STATMON - vulnerable service

N/A CONFIG SUNLINK MAPPER - vulnerable service

N/A CONFIG TFSD - vulnerable service

N/A CONFIG TOOLTALK - vulnerable service

N/A CONFIG X25.inr - service

N/A CONFIG YPBIND - vulnerable service

N/A CONFIG YPPASSWD - vulnerable service

N/A CONFIG YPSERVE - vulnerable service

N/A CONFIG YPUPDATE - vulnerable service

N/A CONFIG YPXFRD - vulnerable service

N/A CONFIG bad resolve request

FTPN/A CONFIG deleting file/directory

318 P<8gs 3 jj<9 8

IPN/A CONFIG - LSRR Loose Source Routing

N/A CONFIG - RR Record Route

N/A CONFIG - SSRR Strict Source Routing

SSHN/A CONFIG - Old SSH Server

N/A CONFIG - SSH protocol mismatch

TelnetCVE-1999-0291 CONFIG WinGate installed

N/A CONFIG . in PATH

TFTPN/A CONFIG - TFTP - Service attempt

WWWN/A CONFIG Directory Browsing Enabled

N/A CONFIG SERVER protocol ERROR

N/A CONFIG www-sql - can access protected files

X11N/A CONFIG . in PATH

XDMCPN/A CONFIG XDMCP traffic

��-��

DNSN/A AUTH DOS Probe

N/A DOS - Traffic FROM trino master

N/A DOS - trino traffic

N/A DOS - trinoo traffic

N/A DOS CICSO router DOS

N/A DOS NT RAS PPTP DOS attempt


F.

Netw

ork

IDS

��3<

:�

FTPN/A DOS Lotus Notes MTA DOS

N/A DOS Serve-U FTP DOS check

FingerN/A DOS recusrsive finger

IPN/A DOS - Fragment too small

N/A DOS - Huge fragment

N/A DOS - IP fragment out of order

N/A DOS - Out-Of-Band Packet- Possible WINNUKE attack

N/A DOS - fragmented packet overlap

WWWN/A ALERT cgi-dos/args.bat vulnerability

N/A DOS Possible Annex DOS

N/A DOS web oracle web server

Gopher

GopherCVE-1999-0124 ALERT GOPHER - known gopher attack

N/A CONFIG GOPHER traffic

N/A SCAN GOPHER - password file

LOKI

IPN/A ALERT ICMP - LOKI Tag in ICMP packet

Port

FTPN/A Bad PORT Command

�

DNSCVE-1999-0166 ALERT NFS attack: ../

CVE-1999-0166 ALERT NFS attack: ../.

320 P<8gs 3 jj<9 8

N/A ALERT Bad requuest Buffer Overflow probe

N/A SCAN - Requested Service Dump

N/A SCAN .rhosts file lookup

N/A SCAN 3270 mapper - service

N/A SCAN ALIS - service

N/A SCAN Browsing

N/A SCAN DATABASE_SVC - service

N/A SCAN ETHERSTATD - service

N/A SCAN KEYSERVD - service

N/A SCAN LLOCKMGR - service

N/A SCAN NLOCKMGR - service

N/A SCAN NSEMNTD - service

N/A SCAN Nessus Scan - IMAil Test

N/A SCAN Nessus Scan

N/A SCAN PCNFS - BAD SERVICE

N/A SCAN REXD - vulnerable service

N/A SCAN RJE MAPPER - service running

N/A SCAN RPCinfo query

N/A SCAN RQUOTAD - service

N/A SCAN RSED - service

N/A SCAN RSTATD - service

N/A SCAN RUSERS - service

N/A SCAN RWALLD - vulnerable service

N/A SCAN Requesting Service IPC$

N/A SCAN Requesting Service ROOT

N/A SCAN Requesting Service WINNT$


F.

Netw

ork

IDS

��3<

:�

N/A SCAN SELECTION SVC - vulnerable service

N/A SCAN SHOWFHD - vulnerable service

N/A SCAN SNMP - service

N/A SCAN SPRAYD - vulnerable service

N/A SCAN STAT - vulnerable service

N/A SCAN STATMON - vulnerable service

N/A SCAN SUNLINK MAPPER - vulnerable service

N/A SCAN TFSD - vulnerable service

N/A SCAN TOOLTALK - vulnerable service

N/A SCAN X25.inr - service

N/A SCAN YPBIND - vulnerable service

N/A SCAN YPPASSWD - vulnerable service

N/A SCAN YPSERVE - vulnerable service

N/A SCAN YPUPDATE - vulnerable service

N/A SCAN YPXFRD - vulnerable service

N/A SCAN password file lookup

N/A SCAN shadow file lookup

N/A SCAN ypcat password

N/A SCAN zonexfer request from outside network

FTPN/A ALERT Possible Buffer Overflow Probe

N/A SCAN Nessus FTP check writable directory

N/A SCAN expn - recon

N/A SCAN looking at passwd file

N/A SCAN possible mailed password file

N/A SCAN possible xfered password file

N/A SCAN verify - recon

322 P<8gs 3 jj<9 8

FingerN/A ALERT Cfinger Search exploit

N/A ALERT compromised finger daemon

N/A ALERT finger pipe attempt

N/A ALERT finger to program

N/A SCAN finger dump

N/A SCAN finger traffic - RECON

N/A SCAN finger traffic - root

GopherN/A SCAN router password file

IDENTN/A SCAN IDENT request

N/A SCAN possible password file

IMAPN/A SCAN possible mailed password file

NNTPN/A SCAN possible password file

POPN/A SCAN possible mailed password file

TelnetN/A ALERT attack - generic IFS probe

N/A SCAN - fingering root user

N/A SCAN - obtaining list of files

N/A SCAN - poking http

N/A SCAN - probe w/ finger

N/A SCAN - wildcard finger

N/A SCAN verfiy - recon

N/A SCAN zone xfer attempt via dig


F.

Netw

ork

IDS

��3<

:�

WWWN/A ALERT Fax Survey cgi probed

N/A ALERT Possible Buffer Overflow Probe

N/A SCAN - using finger to get information

N/A SCAN Accessing WWW Admin Port

N/A SCAN Attempt to grab password file

N/A SCAN Attempting to retrieve passwd file

N/A SCAN Browsing Scripts Directory

N/A SCAN gathering file names

X11N/A ALERT attack - generic IFS probe

N/A SCAN - fingering root user

N/A SCAN - obtaining list of files

N/A SCAN - poking http

N/A SCAN - probe w/ finger

N/A SCAN - wildcard finger

N/A SCAN verify - recon

N/A SCAN zone xfer attempt via dig

324 P<8gs 3 jj<9 8

��

N"TO

"@W?< (adapter)Risk Manager Nlg""@W?<Oj=<9rbK?<7F"j=<9rI}G-kh&K9k#"@

W?<Ops ($YsH) rM@7"$YsHr Tivoli Enterprise Console (TEC) GH(kA0KQ99

k#!$G"@W?<O"$YsHr TEC Kw.9k#$YsH&"@W?<*hS TME "@W?

<b2H#

"@W?<=.!= (Adapter Configuration Facility)Tivoli D-GO"Tivoli "I_K9Hl<?<,""@W?<=.WmU!$krHCF$YsH&"@

W?<rJ1K=.7+9?^$:G-kh&K9k"0iU#+k&f<6<&$s?<U'<9#

"@W?<=.WmU!$k (Adapter Configuration Profile)"@W?<=.l3<IQN3sFJ<#"@W?<=.WmU!$kO""@W?<=.(sI]$

sHX[[G-k#1 DJeN$YsH&"@W?<KD$FNps,^^l"=.U!$kNm1<

7gs""@W?<ND-QtjA (5<P<Nm1<7gsJI)"$YsH&U#k?<jA"*h

S=N>NU!$k[[Wa,^^lF$k#

"I_K9Hl<?< (administrator)rdr2H#

"i<` (alarm)T3J"/F#SF#<,"kH""I_K9Hl<?<&"i<`*hS=N>N=.D=J~z,

/07";-ejF#<I}No</m<IrZ:9k# Risk Manager "@W?<O"&QP<8gs

N ISS RealSecure *hS Cisco Secure IDS (NetRanger) KhCF8.5lk"i<`r TEC $YsH

K^CW9k#Tivoli f<6<Kl]<H5lk"i<`NcKO"Web 9-cs (nTNj9H)"]

<H&9-cs (5<S9Nj9H)"*hSf<6<&m0$sNnT (f<6<>Nj9H) ,^^l

k# TEC $YsHb2H#

$YsH (event)Tivoli D-K*1k"79F`&j=<9"MCHo</&j=<9"^?OMCHo</&"Wj1

<7gsNuVN-zJQ9# Risk Manager GO"djN$YsH"djrhN$YsH"^?O5o

J?9/0;N$YsHr8.G-k#$YsHNcH7FO"LoNh}N+Odd_"h}N[o

J*;"*hS5<P<Nm0nJI,"k# Risk Manager Nlg"$YsHO/~!N$YsHG"

k#

$YsH&"@W?< (event adapter)Tivoli D-K*$F"$YsHr Tivoli Enterprise Console GH(kA0KQ99k=UH&'"#$Y

sH&"@W?<O"$YsHr$YsH&5<P<K>w9k# Tivoli Event Integration Facility (EIF)

^?O Risk Manager Event Integration Facility rH&3HKhj"=l>lNMCHo</D-dCj

N,WK~8F405l?"H+N$YsH&"@W?<r+/9k3H,G-k#"@W?<=.!

= (Adapter Configuration Facility) *hS"@W?<=.WmU!$k (Adapter Configuration Profile) b

2H#

$YsH&/i9 (event class)Tivoli D-K*1k"$YsHNoL#$YsH&"@W?<,$YsH&5<P<Xw.9kpsN

?$Wr(9#

$YsH&0k<W (event group)Tivoli D-K*$F"CjNp`r~?9$YsHN8g#$YsH&3s=<kN"$3sO"F$

YsH&0k<Wr=9# Tivoli "I_K9Hl<?<O"Cj,nNU$HX8N"k$YsH&0

k<WrbK?<G-k#


�

�

$YsH&0k<W&U#k?< (event group filter)Tivoli D-K*$F"$YsH&0k<W&U#k?<O""@W?<&lYkGU#k?<5lk$

YsH&0k<W4HK"$YsHN/i9"=<9"/8;rjA9k#

$YsH&3s=<k (event console)Tivoli D-K*$F"79FÌ}T,$YsH&5<P<+iG#9QCA5l?$YsHr=(7

~zG-kh&K9k"0iU#+k&f<6<&$s?<U'<9 (GUI)#

$YsH&5<P< (event server)Tivoli D-K*$F"$YsHrh}9kf{5<P<#$YsH&5<P<O"e.$YsH4HK

`\rn.9k#$YsH&5<P<O"$YsHrk<k&Y<9KM-go;F>A7"$YsH

X+0*K~z9k+"^?O$YsHr+0*KQ99k+I&+rhj9k#5iK$YsH&5

<P<O"$YsH&3s=<kr=_N$YsHpsG979k# 1 !$YsH&5<P<,xQG

-J$lg"$YsHr 2 !$YsH&5<P<Xw.9k#

(sI]$sH&N<I (end point node)1) Tivoli I}j<8gs (TMR) NfG"I}`nN?<2CHH7F1HG=.5l? Tivoli /i

$"sH#2) 1 DN^N*<K"kN<I#~UN<IH1Al#

N+TO

I}P]N<I (managed node)Tivoli D-K*$F"Tivoli Enterprise Framework ,$s9H<k5lkI}P]j=<9#

/i9 (class)*V8'/HX~_W^?OWm0i_s0K*$F"&LNjAr&Q9k3HKhj"&LNC

-"!="0nr&Q9k*V8'/H2N3H#0k<WNasP<N3Hr"/i9N$s9?s

9H$&#$YsH&/i9b2H#

0iU#+k&f<6<&$s?<U'<9 (graphical user interface)Tivoli D-K*$F"79FÌ}T,=l>lNMCHo</&3sTe<F#s0D-rI}9k

?aKH&0iU#+k&f<6<&$s?<U'<9 (GUI)# Risk Manager $YsH&3s=<kG

O"Tivoli G9/HCW,Holk#$YsH&3s=<kr2H#

6b (attack)vD5lF$J$M*,"MCHo</&79F`N!=rm1K5i=&H9k3H#/~nTb2

H#

N5TO

5<S9826b (Denial of Service attacks)5$P<6bNlo#

79Fè@Y>AWm@/H (vulnerability assessment products)79Fè@Y>AWm@/HGO"79F`r"/F#VK9-cs9k3HKhCF"79FÌ

}TO"BTfNe@HJk5<S9KD$FNsp"^?O=._9Nspru1k#

/~!N79F` (intrusion detection system)1) "/;9)fdU!$"&)<kJIN>N]n!=,/~TKhCFKil?lgK""I_K9

Hl<?<,MCHo</N;}rI0?aKr)D;-ejF#<&D<k#2) bK?<P]j=<

9KP9k6bNnT^?O6bN.yr!P9k#bK?<P]j=<9O"MCHo</NltG

b[9H&79F`NltGb+ôJ$#

/~nT (intrusion attempt)vD5lF$J$M*,"MCHo</&j=<9X"/;97?jKu7?j7h&H9k3H#

326 P<8gs 3 jj<9 8

9/jWH (script)l"N$YsHr=9@}=$#

;s5< (sensor)$YsH&bK?<#

jX(s8s (correlation engine)Risk Manager k<k&(s8s#k<k&(s8sr2H#

0- (attribute)I}P]*V8'/HbK"j"*V8'/H-&,OC-j7F$kps#0-KO"=N0-GX

j5lkpsNOOr(9V?$WWH"=NOONfK^^lkVMW,"k# Risk Manager GO"

F$YsH0-,v0jA5lF$k#=l>lN$YsH0-KO>0HM,"j"3lO6bNC

-r=9QtG<?G"k#0-NA0O"attribute_name=value HJk#"@W?<O"psr$Ys

H&/i9 K,1"3Npsr0-KU)<^CH7"Tivoli $YsH&5<P<Kw.9k#

N?TO

Ev-!: (validation)G<?N5N5"^?OG<?,"Wj1<7gs,J"k<k",'K`r7F$k3Hr4Yk3

H#

N1Y<9&79F` (knowledge-based system)N1Y<9&79F`O"{NN6b*hS79F`Ne@KD$FNpsNG<?Y<9r^`79

F`&(s8srH&#N1Y<9&79F`,Q?<sr'19kH"3liN(s8sO"79F

`,6b5lF$kH[j7F"i<`r/9k#N1G<?Y<9KpE/!NG"k?a"6"i

<`Nf(OsoKc/Jk#

0nY<9&79F` (behavior-based system)79F`&(s8srH$"LoN79F`0nbGk+iNP9r!w9k3HKhj"/~Tr!

N9k#3Nh&J8`*J0nO"vF5lkf<6<hVrBT9k]K"Hl<Ks0|Vr_

j9k3HKhCFjA9k#D^j"3Nh&J79F`GO"{NNQ?<sHlW5;k3HN

G-J$"/7gs,88k?SK""i<`,/89k#lLK"0nY<9&79F`GO"so

Kb$f(G6"i<`,88kbNN"$NN6br/+G-kH$&x@,"k#0nY<9&7

9F`GO"(s8srD-Kgo;F409k,W,"k#

NJTO

MCHo</&Y<9&79F` (network-based system)bK?<rT&[9H,6N7?MCHo</&Q1CHrL7Fpsr}89k#3liNQ1CH

r,O9k3HKhj"f<6<hVrF=[9k3H,G-k#MCHo</&Y<9ND<krH

&H"lYNbK?<GMCHo</4NKD$FNpsr~jG-k?a"j-"N39Hrc/^

(ilk#MCHo</&Y<9ND<kO""Wj1<7gs&G6NG-J$clYkNQ1CH

,X87?6br!NG-k#?<2CH&"Wj1<7gsK~#7J$".y7J+C?6bKD

$Fb"MCHo</&Y<9ND<kKhCF-?5lk#

NOTO

U!$"&)<k (firewall)0N$&HbtNMCHo</rhj}A"@NJG<?@1rLa5;k[9H#

U)<^CH&U!$k (format file)U)<^CH&U!$kO"TME "@W?<N CDS U!$kr8.9k#U)<^CH&U!$k

O"3liN"@W?<N$YsH&/i9rQ97"U)<^CH&U!$k+i77$ CDS U!


�

�

$kr8.9k?aKHQ5lk# Risk Manager GO"TME "@W?<,"G<?rM-go;F"

Tivoli Enterprise Console KAwG-kh&KU)<^CH7>9?aK"3lrHQ9k#

sp"j[o (false negative)6b,88Fb=J,"i<`r8.7J$lgK/89k#/~TN"/7gs,4/$U+l:K

TolkD=-,"kNG"3N1<9O@i+KdjG"k#7?,CF"IDS O Tivoli "I_K9

Hl<?<KP7"gfW@H$&VcC?6Pr?(kD=-,"k#

sp"j5o (real positive)6b,"j"=J,57/sp9kH-N$s9?s9#}[*J IDS GO"6bOsp"j5oKJ

k#

spJ7[o (false positive)spJ7[oO"6b,J$NK=J,"i<`r8.9klgK/89k#spJ7[oKxx9k

"I_K9Hl<?<,T,WJ"/7gsrhkD=-,"kNG"3N1<9OdjHJklg,

"k# IDS ,"I_K9Hl<?<N#lNps;G"klg"v3""I_K9Hl<?<O3l,

spJ7[oG"k3HK$U+J$#7Pi/9kH""I_K9Hl<?<O"3NCj"i<H

O6bKhkbNGOJ$Hd@7""i<`r5k9kh&KJk+b7lJ$#7+7"=3K

O"Risk Manager ,B]N6bb5k7F7^&D=-,"k#

spJ75o (real negative)6b,J$NG=J,"i<`r/7J$H-N$s9?s9#}[*J IDS GO"LoN$YsH^

?Ou1~lD=J$YsHOspJ75oKJk#spJ75oO"aLO$YsHH7FBN=5

lk3HOJ$#F:$YsHN?tO3N+F4j<K:v9k#

[9H (host)MCHo</K*$F"G<?L."/;9}0,8_9kh}uV#

[9H&Y<9&79F` (host-based system)[9H&Y<9&79FÒ"79F`NF:m0rH$"6br!w9k#"Wj1<7gs*hS

*Zl<F#s0&79FÒ"3liNU!$kK`\rw.G-k#7?,CF"[9H&Y<

9&79FÒ"f<6<&;C7gsr8+7Ff/-ANbNG"k#[9H&Y<9&D<kN

x@O"9GK/87?$YsHr4Yk3HKhj"6bN.yH:Tr!:G-k3HG"k#5

iK"U!$k&"/;9^?OC"5<S9XN"/;9JI"CjN79F`&"/F#SF#<

bbK?<9k#

NdTO

rd (roles)"I_K9Hl<?<NrdKO"super"senior"admin"*hS user rd,"k#3liNrdO"f

<6<,$YsHK~z7Fv0Khail??9/2rBT9k3HrD=K9k"vDN8gG"

k#

%hY (priority)Risk Manager O"b%hY"i<`JINh&K""i<`K%hYrdjvFk#?H(P"UNIX

syslogd %hgLQia<?<r_j9k3H,G-k# TME "@W?<Khk3lJ_Nh}KD$

F"$YsHrjb<H UNIX Y<9N syslog G<bsXP)Xj9kH-KO"3NQia<?<

@1rH&#

328 P<8gs 3 jj<9 8

NiTO

)}N (cube)?!5N^?O PowerPlay )}NHbFPlk# Cognos PowerPlay Transformer Khjn.5lk

.mdc U!$kN3H#$/D+N!5KT.5l?,j (G<?) r^_"G<?Y<9NFoSe<

rs!9k#9YFN PowerPlay Se<&U!$k (.ppr) O")}NU!$kKjA5l?Se<r]

$sH9k#

k<k (rule)Tivoli D-K*$F"$YsH&5<P<,$YsHVNX" ($YsHjX) r'17"=lK~8F

+0=5l?~zrBTG-kh&K9k" 1 DJeN@}9F<HasHN8g#

k<k&(s8s (rules engine)k<k&(s8sO"Tivoli Enterprise Console N4!t,G"k#3lOl2Nk<krH$"$Ys

HKP7F"/7gsrBT9k,W,"k+I&+r=L9k#

k<k&Y<9 (rule base)Tivoli D-K*$F"k<kN8gG"j"k<k,n.5lkH-N$YsH&/i9jAN8g#

Tivoli Enterprise Console O"$YsHrI}9kH-K3Nk<k&Y<9rH&#H%O"?/5s

Nk<k&Y<9rn.7"=l>lNk<k&Y<9,"MCHo</&3sTe<F#s0I}N

DLN,Wr~?9h&K9k3H,G-k#

A

ACF"@W?<=.!= (Adapter Configuration Facility) r2H#

ACP"@W?<=.WmU!$k (Adapter Configuration Profile) r2H#

B

BAROC U!$k (BAROC file)C Khk*V8'/HNp\l3<@< (BAROC) U!$k#$YsH&5<P<bN"jAQ_$Y

sH&/i9Nbt=-# Risk Manager Nlg"BAROC U!$kO"Risk Manager "@W?<NC

j?$WKhCF5]<H5lF$k$YsHN/i9r-R9k#

E

EIFTivoli Event Integration Facility r2H# Risk Manager Event Integration Facility b2H#

G

GUI0iU#+k&f<6<&$s?<U'<9 (graphical user interface) r2H#

I

IDS/~!N79F` (intrusion detection system) r2H#


�

�

IISInternet Information Server r2H#

Internet Information Server (IIS)Microsoft Web 5<P<#

J

Java >[^7s (Java Virtual Machine)Java =UH&'"N?aK"79F`KM87J$$s?<U'<9rs!9k=UH&'" (Java i

s?$`D-r^`)#3NQlO"B]N Java >[^7srX9H-KH&bNG" Java is?$`

D-rX9o1GOJ$#

Java is?$`D- (Java Runtime Environment)Java =UH&'"Nis?$`D-rs!9k# Java >[^7s (JVM) NeGT09k#CKm-,

J1lP"3NQlO"Vi&6<"Web 5<P<""k$O>N3sF-9HKhCFs!5lkl

LN Java BTD-rX9bNG" Sun RG-N JRE =JrX9bNGOJ$#

JREJava is?$`D- (Java Runtime Environment) r2H#

JVMJava >[^7s (Java Virtual Machine) r2H#

P

PerlPractical Extraction and Report Language#

PrologProgramming in Logic#@}Wm0i`@lNU!_j<+iNWm0i`@lN 1 D#

R

Risk Manager Event Integration FacilityJ1J"Wj1<7gs&Wm0i_s0&$s?<U'<9 (API) rs!7"\R*hS Tivoli Q<

HJ<, Tivoli SecureWay Risk Manager N77$$YsH&"@W?<r+/7F"$YsHr Tivoli

Enterprise Console X>wG-kh&K9k?aND<k-CH#\RO"5<I&Q<F#<^?OR

b+/N"Wj1<7gs+i"$YsHrQ99k3HbG-k#

T

TECTivoli Enterprise Console r2H#

TEC $YsH (TEC event)Tivoli Enterprise Console G-N$YsH#

Tivoli Enterprise Console79F`""Wj1<7gs"MCHo</"*hSG<?Y<9&$YsHXN$5"/7gsr}

87"h}7"+0*K+O9k Tivoli =J#3lO"9YFN=<9+iN$YsHNf4@KJ

k# Tivoli Enterprise Console KO"8f*+D4N*JMCHo</&3sTe<F#s0D-,w(

ilF$k#psr}89kH-KO,6$YsH&bK?<,"psrh}9kH-KOf{$Ys

H&5<P<,"=7F79F`I}TKpsr(9H-KO,6$YsH&3s=<k,Holk#

330 P<8gs 3 jj<9 8

Tivoli Event Integration FacilityJ1J"Wj1<7gs&Wm0i_s0&$s?<U'<9 (API) rs!7"\R*hS Tivoli Q<

HJ<,77$$YsH&"@W?<r+/7F"$YsHr Tivoli Enterprise Console X>wG-kh

&K9k?aND<k-CH#\RO"5<I&Q<F#<^?ORb+/N"Wj1<7gs+i"

$YsHrQ99k3HbG-k#

Tivoli Management EnvironmentTivoli Management Framework rY<9K7? Tivoli "Wj1<7gs#CjN\Rm1<7gsK$

s9H<k5l"$m$mJWiCHU)<`r[(FMCHo</&3sTe<F#s0I}psK

"/;99k# Tivoli D-K*$F79F`I}TO"=UH&'"r[[7"f<6<=.rI}

7""/;9"rQ97"`nr+0=7"j=<9rbK?<7"8gVr918e<k9k3H,

G-k# Tivoli Management Environment O"J0O TME 10 HN7F$?#

Tivoli Management FrameworkTivoli Management Environment =J2G"Wj1<7gsrBT9kH-K,WKJkp\=UH&'

"#3N=UH&'"N$sUi,0(ilkH" Tivoli H Tivoli Q<HJ<N79F`I}"Wj1

<7gs&Wm0i`r}g9k3H,G-k# Framework KO"!NbN,^^lk#

¶ *V8'/HWaVm<+< (oserv)

¶ ,6*V8'/H&G<?Y<9

¶ p\I}!=

¶ p\"Wj1<7gs&5<S9

¶ 0iU#+k&f<6<&$s?<U'<9 (GUI) JINp\G9/HCW&5<S9

Tivoli Management Environment K*$FO"F/i$"sH*hSF5<P<K Tivoli Management

Framework r$s9H<k9k#?@7"!NlgOc0G"k#

¶ Tivoli Management Framework r/i$"sHNQ<=Jk&3sTe<?<K$s9H<k7?3

H,J/" PC (<8'sHrQ<=Jk&3sTe<?<K$s9H<k7F$klg#

¶ Tivoli I}j<8gs (TMR) 5<P<,"04J*V8'/H&G<?Y<9r]}7F$k#l

N5<P<G"klg#

Tivoli I}j<8gs (Tivoli Management Region)Tivoli Management Environment K*$F" TMR 5<P<JiSK TMR 5<P<HkPlF$k/i

$"sHN8g# 1 DNH%G#tN TMR r_j9k3H,G-k# TMR Oj=<9N*}\3r

X7"]j7<&j<8gsOj=<9N@}T.rX9bNG"k#

TMETivoli Management Environment r2H#

TME "@W?< (TME adapter)s!5lF$k,ZJU)<^CH&U!$krH$" TEC $YsHr8.9k#"@W?<O=UH

&'"&Wm0i`G"j"psr}87"m<+k&U#k?<`nrBT7"X8N"k$YsH

r TEC GH(kU)<^CHKQ99k# Risk Manager GO"IDS ;s5<G TME "@W?<

(UNIX NlgO LogFile "@W?<" Windows NT NlgO NT Event Log "@W?<) ,,WKJ

k#"@W?< (adapter) *hS$YsH&"@W?< (event adapter) b2H#

TMRTivoli I}j<8gs (Tivoli Management Region) r2H#


�

�

332 P<8gs 3 jj<9 8

��

|\l, tz, Qz, Cl8zNgK[s5lF$^

9#J*, y;H>y;O6;H1yK7olF$^

9#

N"TO"/;9&m0&U!$k

5W 116

=. 124

Ev-!: 127

j"k?$`GN97 113, 130, 131

"@W?<

ACF Khk=. 50

ACF WmU!$kKhk=. 50

TEC 16

Windows 79F`GN$s9H<k 44

"@W?<"$s9H<k

Cisco Secure PIX Firewall 167

"@W?<"7,*hS!=/=5l?

jj<9 3.8 NQ9@ 3

"@W?<"Cisco Secure IDS QN

I} 143

d_ 143

f<6<&?9/ 143

TEC ?9/ 143

"@W?<"ISS RealSecure N

I} 152

f<6<&?9/ 152

"@W?<"Risk Manager

Check Point FireWall-1 177

Cisco Secure IDS 140


Cisco k<?< 155

Host IDS 193

ISS RealSecure 147

McAfee Alert Manager 197

Norton AntiVirus 203

"@W?<=.!= (ACF) xvii

"@W?<=.WmU!$k (ACP) xvii

"@W?<N$s9H<k

G-N$s9H<k 39

AIX 39

AIX smit 41

AIX 3^sIT 40

Linux 42

"@W?<N$s9H<k (3-)

Solaris 42

Windows 79F` 44

"@W?<N+O


"@W?<Nd_


"I_K9Hl<?<

Web Y<9Nps 23

"I_K9Hl<?<"Tivoli

$YsHNbK?< 64

qA xvii

"i<H

Network IDS 211

Network IDS"H_~_ 218

"i<`&]j7<N_j


$YsH

*j8Jk 102

EgYN@&s0l<I 67

8.N^) 67

0-N_j 67

E#N!P 77

Ws 103

js/ 76

$YsH (TEC event r2H) 330

$YsHh}"TEC $YsH&5<P<N 16

$YsH>w


$YsHNbK?< 64

$YsHNm.s0


$YsH&0k<W

n. 52

Ws 51

$YsH&3s=<k

5W 14

$YsH&5<P<

$s9H<k 33, 45

97 64

=. 46

Risk Manager 3s]<MsHN|n 64

TEC 16

$YsH&G<?Y<9 13, 15

$YsH&U#k?< 100

$YsH&aC;<8 51


��

$s9H<k

$YsH&5<P< 33, 45

{8Nk<k&Y<9 63

Wh 33

1c= 3

QC1<8 212

aC;<8 253

jj<9 3.8 Na=CINQ9@ 3



Host IDS 194

ISS RealSecure 149

Network IDS 212


Risk Manager QC1<8 36

TEC Correlation 59

Tivoli 0sro=J 34

Tivoli G9/HCW+iN 39

TME "@W?< 45

Web IDS 122

Web Intrusion Detection NEv-!: 127

$s9H<kN`w

Host IDS 194

$s?<U'<9

0iU#+k&f<6<&$s?<U'<9

(GUI) 325, 326

jl<7gJk&G<?Y<9 14

TEC $YsH&3s=<k 326

Tivoli ^?O Tivoli J0 16

&)</9k< 8

(i<h}


(i<&aC;<8

TEC Correlation 227

(s8s

9-CW"sig.nefarious U!$k 120

Hi9H"sig.nefarious U!$k 120, 135

Q<5<"sig.nefarious U!$k 118, 133

Q?<s"sig.nefarious U!$kN 119, 132, 133

suspicion"sig.nefarious U!$k 119, 135

*W7gs

webids 130, 131

*Zl<F#s0&79F`

jj<9 3.8 NQ9@ 4

*Zl<F#s0&79F`N5]<HNWs

jj<9 3.8 NQ9@ 1

N+TO+O

Network IDS 214

TME "@W?< 49

Web IDS 130

5W

Risk Manager 7

+&s?<

:j 137

lYk 136

H%WmQF#<"W3C U)<^CHQN 126

I}

"@W?<"ISS RealSecure N 152


Cisco Secure IDS QN"@W?< 143

Cisco k<?<Q"@W?< 160

Web IDS 128

I}P]N<I

TEC Correlation N$s9H<k 59

I}?9/

TEC Correlation 63

,J"C 89

,' xix

&Lm0&U)<^CH (CLF r2H) 116

H_~_"i<H

Network IDS 218

/i9jA9F<HasH"Tivoli

H_)F 49

F8. 49

tecad_logfile.cds 49

tecad_nt.cds 49

/i9jA9F<HasH&U!$k 18

kg

Risk Manager H TME "@W?<NU)<^CH&U

!$k 47

sig.nefarious Q?<s&F9H 133

!P"E#$YsHN 77

:j

M 136

MN_j 72

+&s?< 137

6b$YsH",O 131

6b70KAc< 133

ISS RealSecure 297

Network IDS 218

6b70KAc<Nps

Cisco Secure IDS 140, 289

ISS RealSecure 147

Network IDS 218, 307

97

$YsH&5<P< 64

k<k&Y<9 63

334 P<8gs 3 jj<9 8

=.

"/;9&m0&U!$k 124

$YsH&5<P< 46



Host IDS 195

iPlanet Web Server 125

Microsoft Internet Information Server 126

Risk Manager Correlation 59

Risk Manager Server Correlation 64

Risk Manager TEC Correlation 60

Web 5<P< 124

=.U!$k 59



Prolog =.U!$kb2H 61

riskmgr_thresholds.pro 57

rmcorr_cfg 60, 63, 64

z(

jj<9 3.8 NQ9@ 4

m~O(i<&aC;<8 51

3^sI

gencds 49

logfile_gencds ^?O nt_gencds 49

nids 216

riskmgr_gencds 91

rmeif_cfg 93

webids ^?O webids.bat 113, 130

wrmadmin 91

wrmsendmsg 91

G-N$s9H<k

"@W?< 39

Risk Manager QC1<8 37

3s]<MsH

|n 54

Risk Manager 11, 36

3s]<MsHN|n 54

N5TO5<P<"$YsH ($YsH&5<P<r2H) 46

5<P<"Web (Web 5<P<r2H) 11

5<P<=.U!$k


F8."CDS U!$kN 49

n.

$YsH&0k<W 52

7,k<k&Y<9 63

(?*Zl<7gs

Network IDS "i<H 215

5^j<&$YsH 103

~VVV

uVG<?N>w 73

-z|B,Zl?uVNA'C/ 70

jUlC7e&?$^<N~VVVN_j 70, 74

7-$M

=.U!$k 82

40 136

jA 82

70KAc< 132


70KAc<"/~


70KAc<&U!$k

Network IDS 214

70KAc<&U!$k (sig.nefarious U!$kr2

H) 117

Xj

T3J"/F#SF#<N?$W 135

EgY 67

`w"$s9H<k


Rp

5]<H5lk Web 5<P< 115

BAROC U!$k 17

CDS U!$k 19


Host IDS 193

Network IDS 209

Network Intrusion Detection System 209

Perl 5]<H 116

Risk Manager Server Correlation 57

Web IDS sig.nefarious U!$k 117

c2"TEC Correlation N 227

\Y="refining sig.nefarious Q?<s&F9HN 133

uV

5W 57

Ws 58

uV$YsH

$YsHrlL*JbN+iqN*JbNX409k

71

$YsHrqN*JbN+ilL*JbNX409k

71

uVG<?">w 73

ps"Risk Manager N xviii

|n

70KAc<&/i9 132

Hi9FCI&70KAc< 135

T3J[9HNjA 134

Web 6b70KAc< 133

|n"s;-e"&$YsHN 72


��

h}

TEC Correlation (i<&aC;<8 227

qA

jj<9 3.8 NQ9@ 5


ISS RealSecure 147

Risk Manager xviii, xix

TEC 0sro=J xvii

Tivoli ;-ejF#<=J xx

7!="\jj<9N 1

/~70KAc<


/~nT

b@ 10

9-CW&(s8s 120

9/jWH&U!$k

rmcorr_cfg 47

9H<`&$YsH

7-$MNjA 75

_j

:jM 72

jUlC7e&?$^<N~VVV 70, 74

_jQ9

Web Y<9Nps 54

;s5<


Cisco Secure IDS (NetRanger) =J 140


ISS RealSecure =J 147

Network IDS 209

Web IDS 113

;s5<N5W


;s5<&"/;9"Q9


;s5<&?$W

jA 66

;s5<&m.s0"=(


;s5<&m.s0"Q9


0sro"$s9H<k 34

0sroHJk=J 13

=<9*hS8hpsNWa


jX

"k4j:`c2N(i<&aC;<8 51

$s9H<k 59

(s8s"Rp 14

1c= 10

Risk Manager Correlation N=. 64

TEC Correlation N=. 60

jXaC;<8 263

0-

msg 102, 103

pix_code 103

pix_ifname 103

pix_sev 103

rm_DestinationIPAddr 103

rm_SensorIPAddr 103

rm_SourceIPAddr 103

N?TOP]IT xvii

?$W"T3J"/F#SF#<N 135

?$`&9?sW

vF5lkQLNjA 69

uVN-z|BNjA 69

@&s0l<I"$YsHNEgYN 67

?9/



?9/"I}

I}?9/r2H 63



ISS RealSecure N"@W?< 152

Web IDS 128

?9/&i$Vij< 107


Network IDS 213

Ev-!:"WebIDS $s9H<kN 127

mUv`"$s9H<kN

ISS RealSecure 150

40

:j+&s?< 137

7-$MH:jM 136

0nY<9/~!N79F` 327

lYk&+&s?< 136

40"$YsHN

lL*JbN+iqN*JbNX 71

qN*JbN+ilL*JbNXN 71

IC

70KAc<&/i9 132

Hi9FCI&70KAc< 135

T3J[9HNjA 134

Web 6b70KAc< 133

G<?Y<9"RDBMS 15

G<?Y<9N5]<HNWs

jj<9 3.8 NQ9@ 2

336 P<8gs 3 jj<9 8

G<?Y<9&Se<NjA

Web Y<9Nps 52

jA

vF5lk?$`&9?sWQL 69

~VVV"-z|B,Zl?uV 70

7-$M 82

uVN-z|B 69

9H<`&$YsHN7-$M 75

;s5<&?$W 66

Hi9FCI&[9H 65

MCHo</&[9H&^7s 65, 77, 79, 81

sig.nefarious Q?<s&(s8s&F9H 133

d_


Network IDS 214

TME "@W?< 49

>w"uVG<?N 73

Aw)fWmH3k / $s?<MCH&WmH3k

(TCP/IP) xvii

H</sNjA 83

IT xvii

Hi9FCI&70KAc< 135

Hi9FCI&[9H

jA 65

Hi9H&(s8s 120, 135

HiCW

Cisco k<?< 161

Hj,< 58

NJTOMCHo</&[9H&^7s 65, 77, 79, 81

NOTOQ<5<&(s8s 118, 133

P<8gs 3.8

^$0l<7gs 285

[V

Web IDS 113, 114

Q9o<I]n


Q?<s&(s8s 119, 132, 133

Q?<s&F9H"sig.nefarious 133

QC1<8"$s9H<k 212

QU)<^s9

jj<9 3.8 NQ9@ 4

s/~70KAc<


s;-e"&$YsH"|n 72

U!$"&)<kI}$YsH


U!$"&)<k&$YsH


U!$k

"/;9&m0 116

/i9jA9F<HasH&U!$k 18

U)<^CH 19

CDS 18

cpfw.baroc 18

crouter_snmp.baroc 18

csids.fmt 20

fmt 19

netranger.baroc 18

nids.baroc 18

os.baroc 18

os_aix.fmt 20

os_nt.fmt 20

os_solaris.fmt 20

pix.baroc 18

pix.fmt 20

pix_nt.fmt 20

realsecure.baroc 18

riskmgr.baroc 17

rmad_summary.rules 103

rmcorr_cfg 60, 63, 64

rmcorr_cfg =.U!$k 47

rmnav.fmt 20

rmvirus.baroc 18

sensor_abstract.baroc 18

sensor_generic.baroc 18

sig.nefarious 117, 133

startconsole.sh iPlanet Web Server 9/jWH 125

webids 3^sI 130

webids.baroc 18

webids.nt,fmt 20

.cds 49

U)<^CH&U!$k 19

$s9H<k 46, 59

kg 47

Ws 20

TEC Nkg 47

U)<^CH&U!$k"Tivoli

tecad_logfile.fmt 20, 48, 49

tecad_nt.fmt 48, 49

#tN$YsH&5<P< 33

T3

$YsHNbK?< 64

T3J

"/F#SF#< 114, 134, 135

[9H 114


��

,O

j0Ghj~s@ps 132

MCHo</&Q1CH 327

Web 6b$YsH 131

Web 5<P<&"/;9&m0 113, 130, 131

Q9@"Risk Manager 3.8 N 1

[9H

jA 65, 77, 79, 81

[9H"T3J 134

[9H>Nh@


]j7<&j<8gs 107

\qKD$F xvii

\qN=. xviii

N^TO^$0l<7gs

P<8gs 3.8 X 285

^(,-ps xvii

aC;<8

$s9H<k 253

jX 263



Event Integration Facility 268

Network IDS 237


Sam /i$"sH 257

Web IDS 277

NdTOf<6<N?9/


Web IDS QN 128

f<6<&?9/

"@W?<"ISS RealSecure N 152


TEC Correlation 63

-z|BZl"uV 69

Ws

"@W?<&?9/ 143, 152

$YsH&0k<W 51

HQ5lk,' xix

uV 58

H</sNjA 83

U)<^CH&U!$k 20

BAROC U!$k 17

Ws (3-)

Prolog =.U!$k 61

TEC ?9/ 107

Web IDS N?9/ 128

Ws!=FsWl<H 103

^)"$YsH8.N 67

NiTOjj<9 3.8 NQ9@ 1

$s9H<k}! 3

*Zl<F#s0&79F` 4

*Zl<F#s0&79F`N5]<HNWs 1

z( 4

qA 5

7,*hS!=/=5l?"@W?< 3

G<?Y<9N5]<HNWs 2

QU)<^s9 4

TEC ?9/ 4

Web 5<P<N5]<HNWs 2

Web Y<9Nps 3

js/"$YsHN 76

k<k&U!$k

$s9H<k 59

Ws 143

k<k&Y<9

$s9H<k 63

97 63

n. 63

?9/&j9H 63

m<I 63

c

jX(9+l<7gs7-$MN_j 84

U)<^CH&U!$kN"k 48

LEA 5<P<N=. 182

wrmsendmsg 91

lYk&+&s?< 136

m<I

{8Nk<k&Y<9 63

Risk Manager 3s]<MsH 36

m<I^CW"$s9H<k 37

m.s0

Network IDSalerts 215

m0&U!$k

Web IDS 116

m0&U)<^CH (CLF r2H) 116

338 P<8gs 3 jj<9 8

AACF

=. 49

=.D=J"@W?< 50

ACF ("@W?<=.!=) xvii

ACF Khk=. 49

ACP ("@W?<=.WmU!$k) xvii

AIX

$s9H<kD=J Risk Manager QC1<8 39

AIX 3^sIT

"@W?<N$s9H<k 40

Cisco Secure PIX Firewall N$s9H<k 41

Host IDS N$s9H<k 41

Network IDS N$s9H<k 41

SNMP 5]<HN$s9H<k 40

Web IDS N$s9H<k 40

BBAROC U!$k 17

$s9H<k 59

Ws 17


Bugtraq Web 5$H 132

CCDS

U!$k 18

CDS U!$k

F8. 49

Check Point FireWall-1

"@W?<N+O 186

"@W?<Nd_ 189

"i<`&]j7<N_j 184

$YsHN>w 179

$s9H<k 179

(i<h} 190

I} 185

=. 179

=.U!$k 180

5<P<=.U!$k 180

Rp 177

;s5<N5W 178

=<9*hS8hpsNWa 187

?9/ 190

U!$"&)<k+i LEA 178

U!$"&)<kI}$YsH 178

U!$"&)<k&$YsH 178

Check Point FireWall-1 (3-)

IP "Il9NWa 186

OPSEC /i$"sH=. 182

OPSEC 5<P<=. 181

SAM 5<P<=. 183

Solaris 3^sIT$s9H<k 43

TEC ?9/ 185

Check Point FireWall-1 N$s9H<k

Solaris 3^sIT 43

Check Point FireWall-1 NaC;<8 254

Check Point FireWall-1 Q"@W?<

TEC ?9/ 185

Cisco Secure IDS

6b70KAc< 289

Rp 140

=JqA 140

=JN Web 5$H 140


Cisco Secure IDS N$s9H<k

Solaris 3^sIT 43

Cisco Secure IDS NaC;<8 259

Cisco Secure PIX Firewall

"@W?<"$s9H<k 167

$YsHNm.s0 174

$s9H<k 167

$s9H<kN`w 167

=. 168

=.U!$k 174

70KAc< 166

70KAc<"/~ 166

Rp 163

/~70KAc< 166

;s5<N5W 164

;s5<&"/;9"Q9 170

;s5<&m.s0"=( 172

;s5<&m.s0"Q9 172

?9/ 173

?9/&i$Vij< 175

Q9o<I]n 169

s/~70KAc< 166

AIX 3^sIT$s9H<k 41


TEC ?9/ 169

TEC k<k 165

Cisco Secure PIX Firewall N$s9H<k

AIX 3^sIT 41

Solaris 3^sIT 44

Cisco k<?<

5W 155

HiCW 161

AIX K*1k SNMP 5]<HN$s9H<k 40

Solaris K*1k SNMP 5]<HN$s9H<k 44


��

Cisco k<?<Q"@W?<

I} 160

CLF

Web 5<P<KhCFHQ5lk 116

Common Vulnerabilities Enumeration (CVE) 132

Comprehensive Perl Archive Network (CPAN r2H) 89

CPAN ,J 89

cpfw.baroc 18

CRITICAL 7-$M 83

crouter_snmp.baroc 18

csids.fmt U)<^CH&U!$k 20

CVE (sHj<

Web 5$H 211

CVE Vf

Network IDS 218

Ddrop_unsecure_events 72

EEIF 87

EIF (Event Integration Facility r2H) 325

EIF (Event Integration Facility) xvii

Event Integration Facilities 325


Event Integration Facility (EIF) xvii

Event Integration Facility NaC;<8 268

Event Logging API (LEA) 177

Ggencds 3^sI 49

HHost IDS

$s9H<k 194

$s9H<kN`w 194

$s9H<k&9FCW 194

=. 195

Rp 193

AIX 3^sIT$s9H<k 41


TEC correlation 193

Host IDS (3-)

TEC ?9/ 196

Host IDS N$s9H<k

AIX 3^sIT 41

Solaris 3^sIT 44

Host Intrusion Detection (Host IDS) 193

IInternet Security Systems (ISS) 147

IP "Il9NJ,


IP "Il9NWa


iPlanet Web Server 125

ISS RealSecure

$s9H<k 149

6b70KAc< 297

Rp 147

qA 147

mUv`"$s9H<kN 150

AIX K*1k SNMP 5]<HN$s9H<k 40

Solaris K*1k SNMP 5]<HN$s9H<k 44

Web 5$H 147

LLEA Event Logging API 177

LEA +iU!$"&)<kXN\3


Linux

"@W?<N$s9H<k 42

Check Point FireWall-1 "@W?<N+O 186

logfile_gencds 3^sI 49

MMcAfee Alert Manager

5W 197

Microsoft Internet Information Server 126

MINOR 7-$M 83

340 P<8gs 3 jj<9 8

NNetRanger (Cisco Secure IDS =Jr2H) 140

netranger.baroc 18

Netscape Enterprise Server 125

Network IDS

"@W?<N+O 213

"@W?<Nd_ 213

"i<H 211

$s9H<k 212

+O 214

5W 209

I}?9/ 214

H_~_"i<H 218

6b70KAc< 218

(?*Zl<7gs 215

70KAc<&U!$k"97 214

70KAc<&Y<9N6b70KAc< 218, 307

d_ 214

[9H>Nh@ 215

aC;<8 237

m.s0 215

AIX 3^sIT$s9H<k 41

CVE Vf 218

IP "Il9NJ, 215

nids 3^sI 216


TEC correlation 210

TEC ?9/ 213

Network IDS N$s9H<k

AIX 3^sIT 41

Solaris 3^sIT 43

Network IDS Q"@W?<

TEC ?9/ 213

Network Intrusion Detection System

$s9H<k&QC1<8 212

$s9H<k&m<I^CW 212

5W 209

I}?9/ 214

aC;<8 237

nids 3^sI

Network IDS 216

nids.baroc 18

Norton AntiVirus

$s9H<k 205

5W 203

TEC correlation 205

nt_gencds 3^sI 49

OObserver

Risk Manager 89

Open Platform for Secure Enterprise Connectivity 177

OPSEC /i$"sH=.


OPSEC 5<P< 177

OPSEC 5<P<=.


os.baroc 18

os_aix.fmt U)<^CH&U!$k 20

os_nt.fmt U)<^CH&U!$k 20

os_solaris.fmt U)<^CH&U!$k 20

PPAN 89

Perl 5]<H

5W 116

pix.baroc 18

pix.fmt U)<^CH&U!$k 20

pix_nt.fmt U)<^CH&U!$k 20

Prolog =.U!$k

Ws 61


Prolog c2N(i<&aC;<8 51

Prolog U!$k

$s9H<k 59

Rratio_down 71

ratio_up 71

RDBMS G<?Y<9 15

realsecure.baroc 18

Risk Manager

"@W?< 12

$YsH&0k<WNWs 51

$s9H<kgx 34

$s9H<k&QC1<8 36

$s9H<k&m<I^CW 37

&)</9k< 8

5W 7

G-N$s9H<k&QC1<8 37

3s]<MsH 11

uV 57

uVNWs 58

qA xviii, xix

/~!N$YsHNbK?< 64


��

Risk Manager (3-)

?9/&i$Vij< 107

jA 7

U)<^CH&U!$kNWs 20

x@ 7

ACF rHQ7?$s9H<k 49

BAROC U!$kNWs 17


iPlanet Web Server N=. 125

Risk Manager Correlation N=. 64

Risk Manager Server Correlation N5W 57

TEC Correlation N=. 60

Web IDS N5W 113

Web 5<P<N=. 124

Web ps xx

Risk Manager 3.8 N*Zl<F#s0&79F`NWs

1

Risk Manager 3.8 NQ9@ 1

Risk Manager Correlation

=. 64

Risk Manager EIF

s TME D-QN=. 93

TME D-QN=. 93

Risk Manager Event Integration Facility 87

Risk Manager Observer 89

Risk Manager Server Correlation

5W 57

Prolog =.U!$k 61

Risk Manager Web IDS N$s9H<k

AIX 3^sIT 40

Risk Manager "@W?<




Cisco k<?< 155, 160

Host IDS 193

ISS RealSecure 147

McAfee Alert Manager 197


Risk Manager 3s]<MsH

$YsH&5<P<+iN|n 64

u7N=( 63

Risk Manager ;s5<

Network IDS 209


Risk Manager N$s9H<k 33

riskmgr.baroc 17

riskmgr_links.pro

9H<`&$YsHN7-$MNjA 75

E#$YsHN!P 77

js/"$YsHN 76

riskmgr_parameters.pro

lL*JbN+iqN*JbNXuV$YsHr409

k 71

vF5lk?$`&9?sWQLNjA 69

qN*JbN+ilL*JbNXuV$YsHr409

k 71

:jMN_j 72

uVG<?N>w 73

uVN-z|BNjA 69

|n"s;-e"&$YsHN 72

>w"uVG<?N 73

-z|B,Zl?uVN/j<s"CW 70

jUlC7e&?$^<N~VVVN_j 70, 74

RiskMgr_Reception 51

RiskMgr_Situations 51


riskmgr_thresholds.pro U!$k 57

rmad_summary.rules 103

rmcorr_cfg =.U!$k 60

rmcorr_cfg U!$k 47, 61, 63, 64

rmeif_cfg 3^sI 93

rmnav.fmt U)<^CH&U!$k 20

rmvirus.baroc 18

RM_Error 51

RM_InputErr 51

RM_PrologErr 51

RM_SituationErr 51

RM_TrustedHosts 51

SSam /i$"sH&aC;<8 257

SAM 5<P<=.



sensor_generic.baroc 18

SET G#l/F#V 104

set_decay_value 72

sig.nefarious

Q?<s&F9H 133

Web IDS 117

sig.nefarious U!$k

GU)kHN$s9H<klj 116

smit

"@W?<N$s9H<k 41

SNMP 5]<H

AIX 3^sIT$s9H<k 40


SNMP 5]<HN$s9H<k

AIX 3^sIT 40

342 P<8gs 3 jj<9 8

SNMP 5]<HN$s9H<k (3-)

Solaris 3^sIT 44

Solaris

"@W?<N$s9H<k 42


Solaris 3^sIT

Check Point FireWall-1 N$s9H<k 43

Cisco Secure IDS N$s9H<k 43

Cisco Secure PIX Firewall N$s9H<k 44

Host IDS N$s9H<k 44

Network IDS N$s9H<k 43

SNMP 5]<HN$s9H<k 44

Web IDS N$s9H<k 43

startconsole.sh iPlanet Web Server 9/jWH 125

status

Risk Manager 3s]<MsHN=( 63

suspicion (s8s 119, 135

TTasks for Enterprise Risk Management

Rp 107

TCP/IP (Aw)fWmH3k / $s?<MCH&WmH3

k) xvii

TEC

"@W?< 16

$YsH&3s=<k 14

$YsH&5<P< 16

qA xvii

Web Y<9Nps 23

TEC Correlation

$YsH8.N^) 67

$YsH0- 67

$YsHNEgYN@&s0l<I 67

$s9H<k 59

(i<Nh} 227

I}?9/ 63

=. 60

=.U!$k 59

7-$MNjA 82

;s5<&?$WNjA 66

H</sNjA 83

Hi9FCI&[9HNjA 65

MCHo</&[9H&^7sNjA 65, 77, 79, 81

riskmgr_thresholds.pro =.U!$k 57

Web IDS QN 120

TEC correlation

Host IDS 193

Network IDS 210


TEC event ($YsHr2H) 330

TEC "@W?<

5W 16

TEC $YsH

bK?< 64

TEC $YsH&3s=<k ($YsH&3s=<kr2

H) 14

TEC ?9/

Ws 107


jj<9 3.8 NQ9@ 4


Check Point FireWall-1 Q"@W?< 185



Host IDS 196

Network IDS 213

Network IDS Q"@W?< 213

TEC k<k


tecad_logfile.cds 49

tecad_logfile.fmt 19, 20, 48, 49

tecad_nt.fmt 19, 48, 49

TEC-Region ]j7<&j<8gs 107, 213

Tivoli

"@W?<=.!= (ACF) xvii

"@W?<=.WmU!$k (ACP) xvii

=JN Web 5$H xx

;-ejF#<I} Web ps xx

Event Integration Facility (EIF) xvii, 325

Risk Manager 7

Risk Manager 0sroN$s9H<k 34

Risk Manager K,WJ=J 13

TEC "@W?<N5W 16

Tivoli Enterprise Console NRp 14

Tivoli Decision Support 221

Tivoli Enterprise Console (TEC r2H) xvii, 330

TME "@W?<

$s9H<k 45

+O 49

jA 331

d_ 49

GU)kH&G#l/Hj<XN$s9H<k 47

Risk Manager U)<^CH&U!$kHNkg 47

Web IDS HNHQ 120

WW3C U)<^CH 126

WARNING 7-$M 83


��

Web IDS

"/;9&m0&U!$k 116

"/;9&m0&U!$kN=. 124

$s9H<k 122

+O 130

5W 113

I} 128

:j+&s?< 137

:j+&s?<N40 137

5]<H5lk Web 5<P< 115

7-$MH:jMN40 136

70KAc<&/i9N|n 132

70KAc<&/i9NIC 132

Hi9FCI&70KAc<NIC^?O|n 135

Q?<s&F9HNkgH\Y= 133

T3J"/F#SF#<N?$WNXj 135

T3J[9HNIC^?O|n 134

f<6<N?9/ 128

lYk&+&s?<N40 136

AIX 3^sIT$s9H<k 40


Microsoft Internet Information Server N=. 126

Perl 0sro 116

sig.nefarious U!$kNRp 117


TEC Correlation 120

Web 6b$YsHN,O 131

Web 6b70KAc<NIC^?O|n 133

Web IDS N$s9H<k

Solaris 3^sIT 43

Web IDS NaC;<8 277


$s9H<kNEv-!: 127

Web 6b

$YsH 131

70KAc< 133

Web 5<P<


Microsoft IIS N=. 126

Risk Manager Khk5]<H 115

Web 5<P<N5]<HNWs

jj<9 3.8 NQ9@ 2

Web 5$H

;-ejF#<I}ps xx

Bugtraq 132

Cisco Secure IDS =JqA 140

Common Vulnerabilities Enumeration (CVE) 132

CVE (sHj< 211

Internet Security Systems (ISS) 147

ISS RealSecure qA 147

ISS RealSecure =JqA 147

Tivoli Risk Manager xx

Web 5$H (3-)

Tivoli =J xx

Web qA

Cisco Secure IDS =J 140

ISS RealSecure=J 147

Risk Manager xviii

Web Y<9Nps

Rp 23

_jQ9 54

G<?Y<9&Se<NjA 52

=(9kps 33

jj<9 3.8 NQ9@ 3

webids 3^sI 130

webids.baroc 18

webids.bat 127, 130, 131

webids.nt.fmt U)<^CH&U!$k 20

Windows 79F`

"@W?<N$s9H<k 44


NCl8zO.baroc U!$k (BAROC U!$kr2H) 17

.cds (/i9jA9F<HasH&U!$kr2H) 19

344 P<8gs 3 jj<9 8

tJVf: CT0P8JA

Printed in Japan

GC88-8881-01

(1P)

P/N:

CT0P8JA

risk manager '[ u'[ y'e k c...

Documents