Wanguard 6.2 User Guide
Configuration » Network & Policy » Response
Configuration » Network & Policy » Response
Responses
provide a unique and powerful way to automate the reaction to traffic anomalies detected by
Sensors, and to filtering rules identified by Filters. If you do not plan to use this feature, you may skip this chapter. To
add a new Response, go to Configuration » Network & Policy » <+> » Response.
When invoked by a Sensor or Filter, the Response runs its contained
actions
. These are modules that provide
means to execute commands, send notifications, write logs, etc. There are two types of actions:
Anomaly Actions
– Executed by Sensor for each traffic anomaly when the anomaly is active (actions
inside the “When an anomaly is detected” panel) or when it expires (actions inside the “When an
anomaly expires” panel).
Filtering Rule Actions
– Executed by Filter for each filtering rule when the rule is active (actions inside
the “When a filtering rule is detected” panel) or when it expires (actions inside the “When a filtering rule
expires” panel). Filtering rules expose malicious packets that share some common OSI layer 3-7 fields
(attacker IPs, TCP/UDP ports, length, protocols, TTL, content, etc.).
To add an action, click the <+> button on the title bar of the proper panel from the left side of the window.
To modify, delete or rename an action, select the action name. To enable or disable an action, click the square button
next to the action name.
Each action panel contains specific fields. The following fields are common:
●
Action Name
– Name or short description of the action.
●
Action Priority
– Select the order of execution relative to the other actions defined in the same panel.
Lower numerical values correspond to increased priority.
●
Periodicity
– Actions can be executed once for each anomaly or filtering rule (if the Preconditions allow),
or periodically. The interval of execution is 5 seconds for Packet Sensor, Packet Filter, Sensor Cluster and
Filter Cluster, and 5-60 seconds (as the Graphs Accuracy parameter) for Flow Sensor.
●
Execution
– Actions can be executed either automatically without requiring end-user intervention, or
manually by an operator or administrator that clicks the “lightning” icon from Reports » Tools »
Anomalies » Active Anomalies » Actions.
●
Record Action
– The name of the action can be recorded and displayed on anomaly reports.
●
Preconditions
– Preconditions are rules that must be passed before the action is executed. When the list
of preconditions is empty, the action is always executed. Each precondition contains a
Conditional
Parameter
, a comparison function, and a user-defined value. Conditional parameters are dynamic,
internal parameters whose values are constantly updated by Sensors and Filters. You can combine
conditional parameters in complex ways (e.g. mix logical disjunction and logical conjunction) by writing a
custom script that uses the conditional parameter named
Custom Script Return Value
.
Dynamic Parameters
are parameters defined within curly brackets { } that can be used as parameters inside
- 27 -
Summary of Contents for wanguard 6.2
Page 1: ......
