About Ankush Kumar

Ankush Kumar · 09-18-2018

Hi Gents, I have a query related to Dwell Time calculation in Security IR. Query is lets say one of the user who was on a leave for a week, returned back from holidays and one day while checking the emails, he opened the malicious attachment which ...

Ankush Kumar · 01-22-2018

Hi Guys, I need one help where there as per requirement we made a custom signature on snort inbuilt in Firepower series. But the issue is its not triggering anything. I am copying the signature which is made and its based on content. The requirem...

Ankush Kumar · 01-20-2018

Hi Gents, I required your support in one of the query which is we are using CISCO ASA 5545 Firewall and its inbuilt AIP-SSM module in IDS fail-open mode. Because its in IDS mode its detecting attacks but the requirement is to know we want packet ...

Ankush Kumar · 01-23-2018

Hi Joel,Thanks again for your quick response.What in case I want either of condition then, can it be accomplished without writing three different rules mentioning different keywords or withing single rule we can accomplish?Regards,Ankush Kumar

Ankush Kumar · 01-23-2018

Hi Joel,Thanks for your reply.Actually the requirement is to trigger an event whenever its matching either cmd, connect or target keywords in any content of URI.Do you want me to write this rule in 3 times after containing different content keywords ...

Ankush Kumar · 01-21-2018

Hi Marvin,One doubt about the posted line ----------------------------------------------------------------------------"If the server replied, it would mean that the attack wasn't detected blocked in the first place and we would thus have no criteria ...

Ankush Kumar · 01-21-2018

Hi Karsten, Thanks for your reply. Quick query on this, in case we are going for Firepower series of ASAs with inbuilt module of IPS engine, then does that provide functionality of packet capture of detecting attacks including server replies? and...

Ankush Kumar · 01-21-2018

Agree and thanks for response.

Member Since	‎01-20-2018 09:54 PM
Date Last Visited	‎09-25-2018 04:01 AM
Posts	8

User Statistics

User Activity

Related to Dwell Time Query

Snort Signature Help Required.

CISCO ASA IDS 7.3(5)E4, Need to save all kind of attacks response.

Re: Snort Signature Help Required.

Re: Snort Signature Help Required.

Re: CISCO ASA IDS 7.3(5)E4, Need to save all kind of attacks response.

Re: CISCO ASA IDS 7.3(5)E4, Need to save all kind of attacks response.

Re: CISCO ASA IDS 7.3(5)E4, Need to save all kind of attacks response.