I have upgraded to VMS 2.1 and have a question about event notifications.
My old CSPM was able to generate USEFULL e-mails about alerts.
The new Security monitor has a lack of good keywords. and does not seem to be able to even give me the signature id of the alert. Let alone where it is from and where it is going.
following are the keywords for each and a sample of my e-mail notifications.
I would really like to get some pertinant info in the event notification.
Can this be done???
VMS e-mail notification
From: notifier.VMS [mailto:notifier.VMS]
Sent: Thursday, March 20, 2003 1:58 PM
To: jbarnes@smtp.ais.ucla.edu
Subject: High TEST.164.67.132.105
(Severity = High)
High TEST
with all keywords
(Severity = High)
30
1
5
2003/03/20
13:58:01 Pacific Standard Time
2003/03/20
21:58:01 UTC
1
1
(((SEVERITY = 3)) AND event_storage_time > '2003-03-20 13:57:01' AND event_storage_time <= '2003-03-20 13:58:01')
1
0
VMS KEYWORDS
Keyword Description
${RuleName}
The name of the event rule.
${RuleDescr}
The description of the event rule.
${Filter}
The query filter for the event rule.
${Interval}
The query interval for the event rule.
${Initial}
The initial threshold for the event rule.
${Repeat}
The repeat threshold for the event rule.
${DateStr}
Date stamp for when the event rule was triggered, based on the server local time. The date stamp is in YYYY/MM/DD format.
${TimeStr}
Time stamp for when the event rule was triggered, based on the server local time. The time stamp is in HH:MM:SS time zone format, where HH is in 24-hour form.
${GmtDateStr}
The Coordinated Universal Time (UTC) date stamp for when the rule was triggered, in YYYY/MM/DD format.
${GmtTimeStr}
The UTC time stamp for when the event rule was triggered in HH:MM:SS time zone format, where HH is in 24-hour form and time zone is always UTC.
${MsgCount}
The number of matches that occurred in the current interval causing this rule to be triggered.
${Threshold}
The threshold that was met, causing the event rule to be triggered. This value is the same as the value for either ${Initial} or ${Repeat}.
${Query}
A time-bounded, syntactically correct SQL expression that can be used in the WHERE clause of a database query to select the set of alarms that caused the rule to trigger this time.
${IntervalCount}
The number of new matching alarms that have been detected causing the rule to trigger this time. This is the number of records that is expected to be returned by a query using the ${Query} keyword.
${RepeatCount}
The number of times the rule has triggered on the repeat threshold. A value of 0 indicates that the rule was triggered on the initial threshold.
CSPM e-mail notification
From: Cisco Secure Policy Manager [mailto:Cisco Secure Policy Manager]
Sent: Saturday, January 11, 2003 2:58 AM
To: jbarnes@ais.ucla.edu; rhinton@ais.ucla.edu
Subject: Level: 5 Node:108 Sig ID: 3216
High Severity Alarms
Time: 02:55:07 2003/01/11
Direction: OUT To IN
Source: 68.112.47.184 Port: 4537 Destination: 164.67.133.76 Port: 80
Signature ID: 3216 Subsignature: 0
Alarm Details: ../..
Message Count: 2
CSPM keywords
Keyword Result of Using This Keyword
${MsgType}
Identifies an integer value indicating the event type: 4 = Alarm.
Note This value is always 4.
${RecordID}
Identifies record ID for the event.
${GlobalTime}
Identifies the GMT timestamp for when the event was generated, expressed in seconds since midnight, January 1, 1970 (time_t).
${LocalTime}
Identifies (sensor-local) timestamp for when the event was generated, expressed in seconds since midnight, January 1, 1970 (time_t).
${DateStr}
Identifies (sensor-local) date stamp for when the event was generated, in YYYY/MM/DD format.
${TimeStr}
Identifies (sensor-local) time stamp for when the event was generated, in HH:MM:SS format.
${ApplID}
Identifies (postoffice) application ID on the sensor that generated the event.
${HostID}
Identifies (postoffice) host ID of the sensor that generated the event.
${OrgID}
Identifies (postoffice) organization ID on the sensor that generated the event.
${SrcDirection}
Identifies the location of the source (attacking) entity with respect to the protected network. Values are "IN" for inside the protected network, or "OUT" for outside the protected network.
${DstDirection}
Identifies location of the destination (attacked) entity with respect to the protected network. Values are "IN" for inside the protected network, or "OUT" for outside the protected network.
${AlarmLevel}
Identifies the severity level of the alarm.
${SigID}
Identifies the signature ID that triggered the alarm.
${SubSigID}
Identifies the sub-signature ID that triggered the alarm, if applicable.
${ProtocolType}
Identifies the protocol of the alarm - always "TCP/IP".
${SrcIpAddr}
Identifies the IP address of the source (attacking) node.
${DstIpAddr}
Identifies the IP address of the destination (attacked) node.
${SrcIpPort}
Identifies the IP port number of the source (attacking) node.
${DstIpPort}
Identifies the IP port number of the destination (attacked) node.
${RouterIpAddr}
Identifies the IP address of the router that sent the syslog message to the sensor (10000 series alarms only); otherwise 0.0.0.0
${AlarmDetails}
Identifies the details and/or context data for the alarm.
${MsgCount}
Identifies the number of events that occurred in the current interval that caused this notification to be generated.
