Directory Harvest Attack Prevention Problem

[rockbd]

I am new in Ironport management.

Last 12 hour i am getting the following warning

Potential Directory Harvest Attack detected.  See the system mail logs for more information about this attack.

Version: 11.1.0-128

Serial Number: 564DA1C84C7E64303E18-53FE25D3BF80

Timestamp: 10 Jul 2018 13:06:30 +0600

Can you please tell me what i should look in the mail log.

Waiting for a suggestion.

[Eric101]

Hello,

These alerts are essentially informational. An outside mail server attempted too many invalid recipients and triggered the Directory Harvest Attack Prevention alert. This threshold is set in the mail flow policy: Mail Policies > Mail Flow Policies under the Host Access Table (HAT) heading.

The best course of action is to do nothing. The ESA is protecting you by automatically telling the remote server to back off as it has sent too many emails to invalid recipients in the last hour. If you find that it is always the same host generating the alert and it is valid you can adjust your thresholds, or reach out to them to find out what is sending so many invalid-recipient emails. (We had people with mailing lists who had recipients who had left the organisation)

More information about the feature can be found here
https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118496-technote-esa-00.pdf

[rockbd]

Too much warning message. In every 1 hour i am getting this warning. Hope IronPort isn't compromise. anything else i can do to control this with Ironport.

[Eric101]

Hello, the appearance of this message is not an indicator that your email appliance is compromised. 

If you no longer wish to receive notifications for this event you can disable it. The process is outlined in the document link in my previous response.


https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118496-technote-esa-00.pdf

Otherwise you will need to investigate and play with the alert thresholds, and/or investigate messages that are causing the alert to see if from a legitimate source (e.g. mailing list with outdated recipients) or illegitimate which you can block with whatever tool is available to you (e.g. firewall, mail policy, etc..)

[guy.zwerdling]

The is a way to find out the sender for that attack?

[Eric101]

Hello, the following article will help you identify the sending host which is triggering the DHAP alert.

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118936-technote-esa-00.html

The entries that describe the DHAP event reside in the mail logs. Here is an example mail log entry when DHAP occurs:

Tue Oct 18 00:25:35 2005 Warning: LDAP: Dropping connection due to potential Directory
 Harvest Attack from host=(192.168.10.1', None), dhap_limit=4, sender_group=SUSPECTLIST

Enter this query into the CLI in order to view the mail logs:

myesa.local> grep "dhap_limit=" mail_logs