The Manager displays attacks categorized as:
Signature-based attacks
Correlated attacks
Non-signature-based attacks (Reconnaissance and DDoS)
Signature-based attacks are the only attacks that contain signatures and so the only attacks that provide signature descriptions. These descriptions will be provided directly in the <Attack name> panel.
.png "GUID-062F63DE-A913-45C4-BD7D-0517A021E20F-low.png")
The following data is displayed depending on the attack:
String patterns used in attack detection
Logical relationship of the condition such as AND, OR and AND THEN based on which the attack was identified.
Comparison fields used to match the signature
String match pattern and value matched
Information after the signature, if applicable
Signature descriptions can be viewed from the Attack Log. Selecting an appropriate alert and viewing its details displays the description of the signature that matched the attack signature. All other signature descriptions in that attack signature will be hidden.
Signature descriptions for each signature type
When identifying a signature-based attack, various components distinguish each attack's contents from another. Each variation consists distinct information that is specific to the attack characteristics. The information comprises one or more conditions (which vary for each attack) that need to be satisfied in order to obtain a match. If the signature is defined by more than one condition, matching is always carried out in an order set by a logical relationship. The logical relationship is regulated by AND, OR, and AND THEN elements.
String-match signatures will display information such as the string match patterns, name of the string fields, and logical relation of the condition.
Example of a string-matched signature with its short description.png "GUID-D163DFD5-A4A7-40C9-99AB-80404B88670E-low.png")
Non-string match signatures will display information such as comparison field name, attack description and logical relation of the condition.
Example of a non-string matched signature.png "GUID-04DDEA0E-CE2F-4DAF-A7B8-4A7832855F26-low.png")
System event (or sysevent) signatures display information such as the name of the system event and logical relation of the condition.
Example of a system event signature with an AND and OR condition.png "GUID-866A1E91-69B6-463E-A730-DDF2784E07BD-low.png")
Signatures with an AND or OR condition will provide you with exact details of the condition.
Signatures with an AND or OR and an AND THEN condition will provide all the constituent conditions.
Example of a signature with AND, OR, and AND THEN conditions.png "GUID-7840FF8E-7C12-418A-9CB2-51F496BDD214-low.png")