Forensic Analysis tab | It is important to examine the preprocessor results to ensure that time-outs and other maximum value exceeded conditions haven’t compromised the analysis. If you see that preprocessors have timed out on hundreds of flows and streams, you may want to adjust preprocessor settings to eliminate these conditions. Intruders often attempt to exceed the limitations of forensic analysis to hide malicious content. The right-click menu lets you examine the rule that triggered the alert (if applicable). It also lets you jump to web-based threat references such asbugtraq for further information about the alert. These references must be coded into the Snort rule to be available from the right-click menu. |
Forensic Analysis Log tab | The Forensic Analysis Log comprehensively lists all rule alerts and preprocessor events in a table, letting you sort individual occurrences by priority, classification, rule ID, or any other column heading. Just click on the column heading to sort the alerts by the given criteria. The right-click menu lets you examine the rule that triggered the alert (if applicable). It also lets you jump to web-based threat references such asbugtraq for further information about the alert. These references must be coded into the Snort rule to be available from the right-click menu. You can also jump to the Decode display of the packet that triggered the alert. |