Event Viewer

Opening the Event Viewer

The Event Viewer can be accessed via CSPM’s tool menu. To start the Event Viewer, choose Tools | View Sensor Events | Database. When the View Database Events window appears, you can choose to view all alarms or you can limit the number of displayed alarms by selecting the start time and/or the stop time.

• Start Time—The start time is used to view alarms generated after the specified time. Alarms generated before the start time aren’t displayed.

• Stop Time—The stop time is used to limit the number of alarms received. Alarms generated after the stop time aren’t displayed.

• Event Type—This is the IDS alarm type. CIDS Alarms is the only option that can be selected.

To open and view alarms using the Event Viewer, use the following steps:

1. Log in to the CSPM host using the administrative account.

2. From within CSPM, select Tools | View Sensor Events | Database.

3. Either select to view all events or specify the start and stop times to limit the scope of alarms displayed.

You can open multiple instances of the Event Viewer. Once an Event Viewer window is open, it can be customized and its display characteristics can be modified independently of all other instances of the Event Viewer. This enables you to open different Event Viewer windows containing the same or different alarms, while adjusting the characteristics of each instance to fulfill a particular need.

Alarm Fields

Each alarm viewed with Event Viewer is displayed as a row in a table. Each row is made up of fields that contain specific data about the alarm. The fields and explanations are provided in Table 26-3.

Resolving Host Names

While viewing alarms in the Event Viewer window, you can easily identify the host names of both the attacking host and the host that was attacked. To resolve the host names, right-click the alarm in question, and then choose Resolve Host Names. A Host Name Resolution window appears, showing the source and destination IP addresses, as well as their associated host name. If the host name can’t be resolved, the window displays Cannot be resolved.

Viewing the Context Buffer

For TCP-based, series 3000 signatures, the sensor captures up to 256 characters of the TCP stream. This information is called the context buffer and you can use the Event Viewer to display it. By viewing the context buffer, you can determine if this alarm was generated by an actual intrusion attempt or simply an accident.

To view the context buffer, right-click the alarm in question, and then choose Context Buffer from the Shortcut menu. A new window will appear, displaying the information contained in the context buffer. If no context buffer is available, the Shortcut menu won’t contain the Context Buffer option.

Network Security Database

Cisco provides a database of network vulnerability information that can be accessed via an HTML browser. If you need additional information for any alarm listed in the Event Viewer, you can search the NSDB for additional information. If the Event Viewer contains an alarm you want to examine, you can open the NSDB to view information about that specific alarm. To open the NSDB, you use the following steps:

1. From the Event Viewer, right-click the alarm in question.

2. Choose Network Security Database.

A second method for opening the NSDM is as follows:

1. Select the alarm to examine.

2. Choose Tools | NSDM from the Event Viewer menu bar.

The NSDB Exploit Signature Page contains additional information about the signature that triggered the alarm. Information provided on the NSDB Exploit Signature page includes the following:

• Signature name

• ID

• SubID

• Recommended alarm level

• Signature type

• Signature structure

• Implementation

• Signature description

• Benign triggers

• Related vulnerability

• User notes

  STUDY TIP?

  Be aware of how to open and view the NSDB.

Once you gain additional information about the matched signature, you might want or need additional information on the related vulnerability. You can select the link provided on the Exploit Signature page to research additional information about the vulnerability. You can learn the following Information via the Vulnerability page:

• Vulnerability name

• Alias

• ID

• Severity level

• Vulnerability type

• Exploit type

• Affected systems

• Affected programs

• Vulnerability description

• Consequences

• Countermeasures

• Advisory/related information links

• Patch/fix/upgrade links

• Exploit links

• User notes

Suspending New Alarms

If desired, you can prevent the Event Viewer from displaying any new or additional alarms. You can use this feature when you’re investigating a previous alarm, and you want to prevent any additional alarms from being displayed in the specific Event Viewer window. The alarms are still recorded and stored in the alarm database, and any other instances of the Event Viewer will continue to display additional alarms. To suspend new alarms in a Event Viewer window, do the following:

1. Choose Edit | Suspend New Events on the Event Viewer menu bar.

or

1. Click the Pause Live Feed button on the Event Viewer toolbar.

To resume receiving new alarms:

1. Choose Edit | Resume New Events on the Event Viewer menu bar.

or

1. Click the Resume Live Feed button on the Event Viewer toolbar.

Deleting Alarms

Once you deal with an alarm in the Event Viewer, you might want to remove the alarm record from the view or from the entire alarm database. You can choose to delete an alarm from the current Event Viewer window, from all Event Viewer instances, or from the CSPM database. To delete the alarm from the current Event Viewer window:

1. Right-click the alarm and choose Delete Record.

2. Select From This Grid.

To delete the alarm from all Event Viewer windows:

1. Right-click the alarm and choose Delete Record.

2. Select From All Grids.

To delete the alarm from the entire database:

1. Right-click the alarm and choose Delete Record.

2. Select From Database.

   Caution?

   If the selected row contains multiple alarms (indicated by a count greater that one) and you choose any of the deletion options, all alarms represented by that row will be deleted. To delete a single alarm represented in a row with multiple alarms, first expand the row, then select the appropriate alarm, and then choose Delete Record.

Expanding and Collapsing the Row

As previously mentioned, the Event Viewer is configured by default to collapse alarms into one record, based on identical information contained in the first two field columns. To view additional information about each alarm, you must expand the columns until the information you need is shown. You can expand the additional information by selecting the row you want to expand, and then click the Expand This Branch One Column to the Right button on the tool bar.

If you want to expand the entire row all the way to the right, select the Expand This Branch all the way to the Right button, located on the Event Viewer tool bar. You can collapse a row back to the left by choosing the Collapse This Branch One Column to the Left button or the Collapse This Branch to the Currently Selected Column button on the Event Viewer tool bar.

By default, all rows are expanded to at least the first two columns. If you want to increase the expansion for all rows beyond the second column, you can configure Event Viewer to do this automatically. To set the default expansion boundary:

1. Select the column which you want to expand.

2. Choose Edit | Set Event Expansion Boundary from the Event Viewer menu bar.

Managing Columns in Event Viewer

Columns can be moved to any position in the Event Viewer. To move a column, click-and-drag the column to the new position. This isn’t a permanent change: if one Event Viewer is closed and reopened, the default column placement will be used.

You can delete columns from the Event Viewer Grid. To delete a column, right-click the column you want to delete, and then select Delete Column from the Shortcut menu. Deleting a column isn’t a permanent change.

You can also select which columns you want Event Viewer to display, as well as how the information in the columns is sorted. To add or remove a column, use the following steps:

1. Choose Edit | Insert/Modify Column(s) from the Event Viewer menu bar.

2. Select the columns you want to view by placing an X in the show field.

3. Click OK.

Actions

The Actions section of the Preference window enables you to set the following parameters:

• Command Timeout—This parameter configures how long (in seconds) the Event Viewer should wait for a response from a sensor before it should consider the connection as down. This setting shouldn’t be changed unless you’ve been experiencing excessive timeout errors.

• Time To Block—This parameter specifies how long (in minutes) a sensor should block traffic from a specified source when the Block command is issued from the Event Viewer. This block time period applies only to Blocks initiated manually from the Event Viewer, not automatic blocks initiated by the sensor. The default is 1,440 minutes (one day), and can be changed to 1 to 525,600 minutes.

• Subnet Mask—The subnet mask is applied to any manually blocked address. If you only want to block the actual attacking host, you should use a netmask of 255.255.255.255. This default subnet mask will be used for all manual blocking.

Cells

The Cells section of the Preference window enables you to configure the following parameters:

• Blank-Left—This configures the Event Viewer not to repeat repetitious information in the most left hand column. If ten alarms are all generated by the same signature, Event Viewer lists the name of the alarm in the first row and it won’t list anything for that column for the next nine rows below. By default, Blank-left is selected.

• Blank-Right—Blank-right affects how the collapsed cells display in the Event Viewer beyond the expansion boundary. By default, Blank-right isn’t selected.

Status Events

The Status Events section enables you to decide whether Event Viewer should list status events (route down, route up, PostOffice messages) in the Event Viewer grid. If this option isn’t selected, then status events won’t be listed in the grid. If you choose Display Popup Window, then all route down messages will generate a pop-up window and other status events won’t be displayed.

Boundaries

The Boundaries section in the Preferences window enables you to configure the following:

• Default Expansion Boundary—Persistent setting that configures the default expansion boundary. By default, this is set to two.

• Maximum Events Per Grid—Configures the maximum amount of rows a single instance of Event Viewer will display. The default is 250,000 alarms and can be changed from 1 to 4,000,000,000.

• Event Batching Timeout—Configures how often, in seconds, the Event Viewer is updated during an alarm flood. The default is 0, meaning the Event Viewer is constantly updated with new alarms as they’re generated.

Event Severity Indicator

The Event Severity Indicator section of the Preferences window enables you to configure the color and icons used to represent the different signature alarm severities. The colors affect the background of the Count field for each alarm. You can also change the icon used to represent the severity listed for each alarm. The default colors and icons used for each severity are listed in Table 26-4.

Severity Mapping

Alarms are assigned a level of severity from one to five. These alarm levels are mapped to a severity of Low, Medium, or High. Table 26-2 shows the default mapping of alarm levels to severity levels. You can change the default mapping of alarm levels to severity levels using the Severity Mapping section of the Preferences window.