rare iptable delete command

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

rare iptable delete command

L0 Member

We received couple of alerts on rare iptable delete command.On checking the host activity, we could able to observe all commands including newly entered command in the host machine but not able to see the iptable delete/flush command in the activity log under Query builder.

1 REPLY 1

L3 Networker

Hi Muthuvel, 

 

I think the question is how can we see delete/flush command ?

But event its, still some of the important informations are missing like

What is the alert source? 

did you try to investigate casualty chain? 

did you check action_remote_process_image_command_line or actor_process_command_line fields for parameters? 

is your time line correct when you use Query builder?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!