Application and Threat Summary report

OmarKhan — Tue, 17 Dec 2013 05:47:34 GMT

Hello,

i am confused a little bit when i found out that 10.0.0.0-10.255.255.255 is listed in Top 5 Destination country. What actually refers 10.0.0.0-10.255.255.255 in this instance?

Regards,

Re: Application and Threat Summary report

kadak — Tue, 17 Dec 2013 19:25:44 GMT

Hello OmarKhan,

I believe you trying to figure out the top 5 attackers (in terms of countries) in your threat summary report. If that is the case, we should look at the Top5 source country column. In threat logs as compared to traffic logs, the source (attacker) and destination (victim) definitions are flipped. In your case, 10.0.0.0-10.255.255.255 are IP addresses in your LAN network - 10.0.0.0/8 which are referred as victims.

For example:

Traffic log:

Threat log:

In the above example, 192.168.0.0-192.168.255.255 are being attacked by an IP address from US : 173.199.132.56

Hope that helps!

Thanks and regards,

Kunal Adak

topic Re: Application and Threat Summary report in General Topics

Application and Threat Summary report

Re: Application and Threat Summary report