Table of Contents
Advertisement
Exploit Detection
Exploit Detection enables immediate, actionable notification of attacks on vulnerable systems. It
provides a real-time link between intrusion detection system signatures and vulnerability scan
results, notifying users automatically and immediately when an attack attempts to exploit a
vulnerable system. This dramatically improves the efficiency and effectiveness of incident response.
Exploit Detection provides users with updates of mappings between intrusion detection systems and
vulnerability scanner product signatures. The mappings include a comprehensive list of intrusion
detection systems and vulnerability scanners. Users simply upload vulnerability scan results into
Sentinel. Exploit Detection automatically parses them and updates the appropriate intrusion
detection system Collectors. It uses the embedded knowledge of vulnerability status to efficiently
and effectively prioritize responses to security threats in real time.
When an attack is launched against a vulnerable asset, Exploit Detection alerts users with the
corresponding severity level of the exploited vulnerability. Users can then take immediate action on
high-priority events. This takes the guesswork out of alert monitoring and increases incident
response efficiency by focusing reaction on known attacks against vulnerable assets.
Exploit Detection also enables users to map or "un-map" signatures and vulnerabilities to tune out
false positives and negatives and to leverage custom signatures or vulnerability scans.
A.4.2 Business Logic Layer
Sentinel services run in specialized containers and allow unparalleled processing and scaling
because they are optimized for message-based transport and computation. The key services that
make up the Sentinel server include:
"Remoting Service" on page 403
"Data Access Service" on page 404
"Query Manager Service" on page 404
"Correlation Service" on page 404
"Dynamic Lists" on page 405
"Workflow Service (iTRAC)" on page 405
"Event Visualization" on page 405
"Incident Response Through iTRAC" on page 407
"Reporting Service" on page 409
"Advisor" on page 409
"Health" on page 409
"Administration" on page 409
"Common Services" on page 409
Remoting Service
Sentinel's Remoting Service provides the mechanism by which the server and client programs
communicate. This mechanism is typically referred to as a distributed object application.
Sentinel 6.1 Rapid Deployment Architecture 403
Advertisement
Table of Contents
