Alert if same traffic log entry is repeated N times..

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Alert if same traffic log entry is repeated N times..

L4 Transporter

We have had an instance of a third party having an issue with their system that generated repeated traffic over and over 17K 5 times a second, constantly.

 

I can match the traffic in the log fairly easily. 

 

How can I set up an alert for that to go to our application owner? 

 

I can't figure out a way to do it other than a daily scheduled report which is not great.

 

Rob

2 REPLIES 2

Cyber Elite
Cyber Elite

Hello,

A SIEM is your best bet at that point. While there are reporting functions on the device, a SIEM can do a lot better. Also perhaps a zone protection or DOS policy could help out?

 

Regards,

Hmm... SIEM is not implemented yet although it's budgeted and we have gone through the entire selection process.. It's just queued down the project list..

 

Will have to have a think.

  • 1910 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!