Zone Protection /Host Sweep settings...

SOC_CSG — Mon, 02 Jun 2014 10:27:17 GMT

I tried to adjust the "Host sweep," according to my network traffic, but I don`t get the results that want:

Inteval (sec) : ?

Threshold (events) : ?

Example: Given these threats

I made the following query to see the number of events in 10 seconds:

( addr.src in 172.16.29.111 ) and ( port.dst eq 161 ) and ( receive_time geq '2014/06/02 11:56:00' ) and ( receive_time leq '2014/06/02 11:56:10' )

Result: 1354 events in 10 seconds.

it does not work.

I have also tried adding exceptions, but does not work, this not stop to generate threat :

This is internal traffic and generated me threat "SCAN: Host Sweep" :

I don´t know if I'm doing well or not?

Could anyone help me?

dicu

Re: Zone Protection /Host Sweep settings...

winwan — Mon, 30 Jun 2014 09:53:21 GMT

please visit this link:

ddharmalingam — Sat, 10 Jan 2015 01:46:05 GMT

That IP exception is for user identification not for Zone Protection.