FireSIGHT Application Detector HTTP/SSLv2

[Netmart]

Hello,

I was wondering, whether it is possible to create an Application Detector for HTTPs connections including SSLv2 Client Hello Requests.

If not is there any alternative how to capture and eventually block those kind of events with FireSIGHT.

Thanks,

[yogdhanu · Accepted solution]

Hi

I am assuming you need to block any connection attempt with SSLv2.

You can do that using intrusion rules. Snort rule(1:38060) POLICY-OTHER SSLv2 Client Hello attempt is available which (if configured to block) would block any client hello packet with SSLv2

Hope this helps,

Yogesh

[Netmart]

Thank you very much. Yes, that's what I meant.