 |
The Preferences feature in PCM provides the tools to control and adjust the NBAD detection sensitivity and manage the NBAD options to fit your particular environment.
» Return to top
4.1 Configure the security monitoring preferences
To configure Security Monitoring Preferences for Network Immunity Manager:
- In NIM, go the Preferences menu and select the Security Monitoring option. You see the Security preferences configuration window. In this window, ensure that Analysis Sensitivity has been adjusted to level 2 for all types of alerts:
- Under Security Monitoring, select Excluded Devices. You see a list of excluded devices. The PCM/IDM server (here, 10.1.10.10) has automatically been excluded from all alerts. Routers have been excluded from Duplicate IP, IP spoofing, and IP fanout alerts.
- Go to the Global: Policy Management window. By default, the Configuration Changes setting is Log actions
that would be taken by policies but do not allow device configuration changes. This allows you to test policies,
while not enforcing any actions, before applying the policies in a real production mode.
Here you want to show actions, so choose the option to Log actions that would be taken by policies and allow device configuration changes:
» Return to top
4.2 Simulate an attack
To simulate and monitor an attack:
- Connect the attacker to port 5 on the HP ProCurve 5400zl.
- Use Nmap to launch an Xmas scan to the entire subnet:
- Target: 10.1.10.0/24
- Options: -p 0-65535 -sX
After a few seconds, you see the scan appear under Network Management Home in the Events window of
PCM+, with source NBAD. You see the source IP address (10.1.10.x), the source MAC address, and the
event description (TCPFlagsFinSetButNoAck Protocol anomaly…).
» Return to top
|
