Saving Logs; Stopping An Active Response - HP Compaq t5700 User Manual

The Trace route field provides details, such as IP address, on each hop made by the
data packet that was logged by the Agent. A hop is a transition point, usually a router,
that a packet of information travels through at as it makes its way from one computer
to another on a public network, such as the Internet.
4. To view detailed information on each hop, click the WhoIs>> button.
A drop panel displays detailed information about the owner of the IP address from
which the traffic event originated. Note that the information displayed does not
guarantee that you have discovered who the hacker actually is. The final hop's IP
address lists the owner of the router that the hackers connected through, and not
necessarily the hackers themselves.
5. Click either Whois<< again to hide the information.
Note: You can cut and paste the information in the Detail information panel by
pressing Ctrl+C to copy the information into the Clipboard.
It is not advisable to contact persons listed in the Detail information panel unless
you are experiencing a high number of security logs in which the attacks originate
from one particular IP address.
6. Click OK to return to the Log Viewer dialog box.

Saving Logs

The contents of the logs can be saved to different locations. You may want to do this to save
space, but is it more likely that you do this for security review, or to import them into a tool
such as Microsoft Excel.
To save a log file:
1. Open the log in the Log Viewer.
2. Click File|Export....
3. In the Save As dialog box, select the location for the log file.
4. Click OK.

Stopping an Active Response

Any security attack that is detected on the Agent triggers an active response. The active
response automatically blocks the IP address of a known intruder for a specific amount of
time (the default is 10 minutes). If you don't want to wait the default amount of time to
unblock the IP address, you can stop the active response immediately.
You can stop active responses in the Security Log only.
Monitoring and Logging
37