botnet-domain alert in GUI

helenio.sartori — Tue, 30 Apr 2013 08:38:51 GMT

Hello,

on the cli show command I see under "XX Anti spyware" profile the botnet-domains policy but I'm not able to find it on GUI under object-securityprofiles -> antispyware.

Where botnet-domain behavior is configured on GUI ?

thank's .. here below the Cli output:

spyware {

"XX Anti Spyware" {

rules {

simple-critical {

severity critical;

packet-capture no;

threat-name any;

category any;

action {

alert;

}

simple-high {

severity high;

packet-capture no;

threat-name any;

category any;

action {

alert;

}

simple-medium {

severity medium;

packet-capture no;

threat-name any;

category any;

action {

alert;

}

simple-low {

severity low;

packet-capture no;

threat-name any;

category any;

action {

alert;

}

threat-exception {

12652 {

action {

allow;

}

20000 {

action {

allow;

}

botnet-domains {

packet-capture no;

action {

alert;

}

Re: botnet-domain alert in GUI

gwesson — Tue, 30 Apr 2013 17:09:52 GMT

This is found under the DNS Signatures tab of the Anti-Spyware Profile:

You can configure the action and whether or not to take a packet capture.

Note that the default two profiles, "default" and "strict" cannot be modified. You will have to create a new one as you have done to modify this setting.

Hope this helps!

Greg Wesson

topic Re: botnet-domain alert in GUI in General Topics

botnet-domain alert in GUI

Re: botnet-domain alert in GUI