HP T5700 HP Sygate Security Agent User Guide - Page 47

Saving Logs, Stopping an Active Response, Trace route, WhoIs>&gt, Detail information, Ctrl+C

Get HP T5700 - Compaq Thin Client PDF manuals and user guides View all HP T5700 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 47 highlights

Monitoring and Logging The Trace route field provides details, such as IP address, on each hop made by the data packet that was logged by the Agent. A hop is a transition point, usually a router, that a packet of information travels through at as it makes its way from one computer to another on a public network, such as the Internet. 4. To view detailed information on each hop, click the WhoIs>> button. A drop panel displays detailed information about the owner of the IP address from which the traffic event originated. Note that the information displayed does not guarantee that you have discovered who the hacker actually is. The final hop's IP address lists the owner of the router that the hackers connected through, and not necessarily the hackers themselves. 5. Click either Whois

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
Monitoring and Logging
The
Trace route
field provides details, such as IP address, on each
hop
made by the
data packet that was logged by the Agent. A hop is a transition point, usually a router,
that a packet of information travels through at as it makes its way from one computer
to another on a public network, such as the Internet.
4.
To view detailed information on each hop, click the
WhoIs>>
button.
A drop panel displays detailed information about the owner of the IP address from
which the traffic event originated. Note that the information displayed does not
guarantee that you have discovered who the hacker actually is. The final hop’s IP
address lists the owner of the router that the hackers connected through, and not
necessarily the hackers themselves.
5.
Click either
Whois<<
again to hide the information.
Note:
You can cut and paste the information in the
Detail information
panel by
pressing
Ctrl+C
to copy the information into the Clipboard.
It is not advisable to contact persons listed in the
Detail information
panel unless
you are experiencing a high number of security logs in which the attacks originate
from one particular IP address.
6.
Click
OK
to return to the Log Viewer dialog box.
Saving Logs
The contents of the logs can be saved to different locations. You may want to do this to save
space, but is it more likely that you do this for security review, or to import them into a tool
such as Microsoft Excel.
To save a log file:
1.
Open the log in the Log Viewer.
2.
Click
File|Export...
.
3.
In the
Save As
dialog box, select the location for the log file.
4.
Click
OK
.
Stopping an Active Response
Any security attack that is detected on the Agent triggers an active response. The active
response automatically blocks the IP address of a known intruder for a specific amount of
time (the default is 10 minutes). If you don’t want to wait the default amount of time to
unblock the IP address, you can stop the active response immediately.
You can stop active responses in the Security Log only.
37