Understanding Exploit Detection; How Exploit Detection Works - Novell SENTINEL 6.1 SP2 - 02-2010 User Manual

 Real-time attack data: Intrusion detection systems report real-time attacks against enterprise
assets. However, this data does not indicate the impact of the attacks.
The real-time attacks that are generated as events are loaded into the Sentinel database by using
the intrusion detection systems or vulnerability type Collectors.

8.2 Understanding Exploit Detection

Section 8.2.1, "How Exploit Detection Works," on page 160

 Section 8.2.2, "Generating the Exploit Detection File," on page 162
Section 8.2.3, "Viewing the Events," on page 162


8.2.1 How Exploit Detection Works

Exploit detection instantly sends notification when an attack is attempting to exploit a vulnerable
system. The Exploit Detection feature depends on the following:
Both vulnerability scanners and the intrusion detection systems must report vulnerabilities and

attacks against the same set of systems. In Sentinel, systems are identified by their IP addresses
and their MSSP Customer Name. The MSSP Customer Name is a namespace identifier that
prevents overlapping IP ranges from matching incorrectly.
 The vulnerability scanner and intrusion detection system products must be supported by the
Advisor service. This data uses specific product identifiers to ensure proper matching.
 The specific reported attacks and vulnerabilities must be known to the Advisor service and
Exploit Detection.
All Collectors shipped by Novell
supported by Advisor. To write your own vulnerability or intrusion detection Collector, or to modify
one of the shipped Collectors, refer to the
index.php?title=Develop_to_Sentinel)
fields must be filled in to support this service.
The following table lists the supported products with their associated device type (IDS for intrusion
detection system, VULN for vulnerability scanners, and FW for firewall).
Supported Products and the Associated Device Types
Table 8-1
Supported Products
Cisco* Secure IDS
Enterasys* Dragon* Host Sensor IDS
Enterasys Dragon Network
Sensor
Intrusion.com
(SecureNet_Provider)
ISS BlackICE PC Protection
ISS RealSecure* Desktop
160 Sentinel 6.1 User Guide
®
meet these requirements, as long as they are declared as being
Sentinel Plug-in SDK (http://developer.novell.com/wiki/
for specific information about which event and vulnerability
Device Type
IDS
IDS
IDS
IDS
IDS
RV31 Value
Secure
Dragon
Dragon
SecureNet_Provider
XForce
XForce