Cisco CS-MARS-20-K9 - Security MARS 20 User Manual page 572

List of System Reports
This report ranks hosts by the number of password attacks attempted on them. Passwords attacks
include attempts to (a) capture passwords, either remotely or locally and (b) guess passwords.
Password guessing attempts are recorded as authentication failures by IDS and hosts.
Attacks: Password - Top Destinations.
•
Attacks: Password - Top Destinations
Attacks: Password - Top Event Types.
•
This report ranks password retrieving and guessing attacks. The password can be system passwords
or application passwords.
Attacks: Password - Top Event Types.
•
Attacks: Password - Top Event Types
Attacks: Password: Locked Accounts - All Events.
•
This report details password attacks on locked/disabled/expired accounts.
• Attacks: Password: Locked Accounts - All Events.
Attacks: Password: Locked Accounts - All Events
Attacks: Password: Restricted Times - All Events.
•
This report details all events that indicate login failures at restricted times - the hosts are specifically
configured to disallow access at these hours.
Attacks: Password: Restricted Times - All Events.
•
Attacks: Password: Restricted Times - All Events
Attacks: RPC Services - Top Event Types.
•
This report ranks attacks on RPC based applications.
Attacks: RPC Services - Top Event Types.
•
Attacks: RPC Services - Top Event Types
• Attacks: SANS Top 20 - Top Event Types.
This report ranks the attacks that have been included in SANS Top 20 list.
Attacks: SANS Top 20 - Top Event Types.
•
Attacks: SANS Top 20 - Top Event Types
Attacks: SNMP - Top Event Types.
•
This report ranks SNMP based attacks over the past hour.
Attacks: SNMP - Top Event Types.
•
Attacks: SNMP - Top Event Types
• Attacks: Uncommon or Anomalous Traffic - Top Event Types.
This report ranks the events that represent uncommon or anomalous traffic. Uncommon traffic
involves ICMP types and TCP/IP options not in common usage or standard traffic on non-standard
ports. Anomalous traffic includes traffic that violate IETF or other well known protocol
specifications.
Attacks: Uncommon or Anomalous Traffic - Top Event Types.
•
Attacks: Uncommon or Anomalous Traffic - Top Event Types
• Attacks: Virus/Worms - Top Sources.
This report ranks addresses that are the source of virus/worm propagation attempts.
User Guide for Cisco Security MARS Local Controller
D-32
Appendix D System Rules and Reports
78-17020-01