Is there any way to resolve the reported IP address in a signature that fired into a hostname? Here's the background as to why:
We have a customer with a custom signature. We have a list of authorized devices which basically tells us not to sound the alarms if a particular host fires this signature. All others, we need to let them know.
When this signature fires, it only shows the source IP address. Many of the authorized hosts are on a network that uses DHCP. So, we can't filter out by IP address since these are dynamic. All we know for certain are the hostnames that are authorized.
Any way to make the IDS resolve hostnames for a particular signature? Even for all signatures if a global command exists?
Thanks!!
Jim
