New in the Rewards Catalog: Vouchers for "Symantec Technical Specialist" and "Symantec Certified Specialist" exams.

View
Track

shaun_b

Profile

shaun_b

Partner

Accredited

Member for: 4 years 15 weeks
Contact: Send this user an email

Job Title: Senior Security Analyst

Member for: 4 years 15 weeks

Blog: View recent blog entries

Contribution Stats

3

Solutions

5

Forum Threads

121

Comments

0

Blog Entries

2

Ideas

3

Articles

0

Videos

0

Downloads

0

Events

1

Group Joined

shaun_b's Activity

Show:

discussion comment 08 Apr 2010

shaun_b commented on: Restoring incidents

this might help... but i'm not sure if what your trying to do is possible... http://service1.symantec.com/support/ent-gate.nsf/854fa02b4f5013678825731a007d06af/a7b36fa26cc4bcb3882575d700770c38?OpenDocument

discussion comment 08 Apr 2010

shaun_b commented on: Correlation rule question - multiple persistent logins

You may be able to accomplish this with the Negative Rule type introduced in 4.7. Not 100% sure though. You'd probably have to tweek the event count (in order to show 2 successful logins), or find some other way of determining a user ...

discussion comment 08 Apr 2010

shaun_b commented on: IP Range for SSIM LiveUpdate Servers

You need to create a host entry in the Juniper. I'm familiar with the SSG models and this is possible. When creating an address location just use the dns name instead of the IP.

discussion comment 12 Nov 2009

shaun_b commented on: php-cgi.exe behaviour

I've noticed this on a few installations of RU5 as well. Weird.

discussion comment 21 Oct 2009

shaun_b commented on: MSSQL audit

There are supported collectors for MS SQL. 2000 and 2005. Or are you specifically talking about the Audit Logs of SQL?

discussion comment 21 Oct 2009

shaun_b commented on: How to reduce or optimize consuming resource of SIM

Filter the events you don't need to see or correlate on via the sensor configurations on the SSIM. Reduce the EPS rate if you've explored all other options.

discussion comment 21 Oct 2009

shaun_b commented on: Alerts / incidents auto close

Well the whole point of a SSIM is to create incidents that requrie some level of analysis to determine the risk it applies to the organization. Your best bet may be to just use alerts as you identified above. I'm sure you can script ...

discussion comment 21 Oct 2009

shaun_b commented on: Clearing logs

Just go to the SSIM's web interface, then database utilities. You will see the many options you have to purge the database of events, incidents, etc based on a myriad of different criteria. Should do the trick perfectly.

discussion comment 21 Oct 2009

shaun_b commented on: SIM 4.6 Installation - Cannot Connect to DataStore

1. Did you fully patch the appliance after the preliminary 4.6 install? 2. Check the datastore to see if it is indeed corrupt - ...

discussion comment 21 Oct 2009

shaun_b commented on: SSIM 4.6 installation - domain name

could be the dash, but not sure. That's a hella long domain name.

discussion comment 29 Sep 2009

shaun_b commented on: SIEM sizing

You'll be reaching a significant threshold trying to collect 10k EPS on an HP blade. Those hardware suggestions in your link are recommended for high performance networks, which I would constitue a 10k EPS environment in there. I ...

discussion comment 29 Sep 2009

shaun_b commented on: agent 4.7

here is a good article on queue sizing... http://service1.symantec.com/support/ent-gate.nsf/854fa02b4f5013678825731a007d06af/2d7f4c440d0c54d78825740f004ab577?OpenDocument

discussion comment 29 Sep 2009

shaun_b commented on: SSIM 4.6 and Checkpoint Event Collector

DEBUG 2009-09-24 09:19:57,897 Collectors.3120.sender Thread-44 key = event_desc; value=OpsecLeaSensor(Sensor 0) error in readDevice(). Sensor will be reopened. Details: Unknown exception.; ...

discussion comment 24 Sep 2009

shaun_b commented on: SSIM 4.6 and Checkpoint Event Collector

Using that same agentmgmt.sh script, stop and start the Agent. Then go back into the log file and post what you have. Make sure to include as much information as possible. "tailing" it won't give us everything. "cat" may be a ...

discussion comment 23 Sep 2009

shaun_b commented on: agent 4.7

The max queue size is what controls how many events we will hold in the queue before dropping events. This is in environments where there is a heavy EPS count. When you have situations where your getting close to the threshold of your ...

discussion comment 23 Sep 2009

shaun_b commented on: SSIM 4.6 and Checkpoint Event Collector

The line item for logging will already be there, it will just be set to INFO. You need to change INFO to DEBUG. The line is near the top of the file and easy to find. You can also just use the agentmgmt.sh script to do this as ...

discussion comment 23 Sep 2009

shaun_b commented on: SSIM 4.6.1.24 and Symantec Endpoint Protection

What I do is edit that rule to reflect external traffic just like you mentioned. Also take a look at the trojan list of ports, and remove things that have been validated as false positives within your environment.

article comment 27 Aug 2009

shaun_b commented on: Buffer Overflow Part 1 -The Basics

Good article. I think it's important any security analyst knows the basics behind a BO. Given the fact that they are responsible for a vast amount of the vulnerabilities that are out there, it's important to know how to address them accordingly.

discussion comment 26 Aug 2009

shaun_b commented on: supporting documents that all those items can be monitored by ssim.

http://www.symantec.com/connect/forums/security-information-manager-product-guide-locations

discussion comment 26 Aug 2009

shaun_b commented on: supporting documents that all those items can be monitored by ssim.

There are collectors for Windows Event logs, SQL and Oracle. Not sure about MySQL but the regular SQL collector may work there. The Cisco environment also has supported collectors. All of this information is available on Symantec's support ...