We're experiencing a problem with Sig ID 2156, the Nachi Worm ICMP Echo Request signature. The problem we're seeing is once the signature fires, the destination IP address in the alarm is actually the machine that's infected with Nachi and the sourc...

I'm trying to run sysconfig-sensor and get an error msg after I enter the values for option 6, communications infrastructure. The error basically says the eventd.conf file cannot be modified because it's a read only file system. Please see below fo...

Does anyone have a sig to apply for this advisory?"CERT Advisory CA-2002-33 Heap Overflow Vulnerability in Microsoft DataAccess Components (MDAC)"I'm not sure if signatures 5070 or 5071 would really address it.

I'm really in search of the answers to a few questions. Thought I'd post it here and see what you have to say. Here goes......What could you use from a 4210 in the way of log files to report malicious activity to abuse@whoever.com? What do you have...

Could anyone share a possible string match entry to alarm on the SQL worm that's in the wild? Thanks a bunch.