Document toolboxDocument toolbox

Platform alert pack: IDS

Purpose

Detect malicious findings from IDS systems.

Included alerts

SecOpsBroHttpRequestSingleHeader

SecOpsBroRdpBruteForceSuccessHydraNcrack

SecOpsBroSelfSignedCert

SecOpsBroSmbFirstSeenShare

SecOpsBroSshInteresingHostNameLogin

SecOpsBroWinDceRpcSamrEnumeration

SecOpsBroWinLsatUserEnumeration

SecOpsBroWinDceRpceServiceCall

Prerequisites

To use this alert pack, you must have the following data sources available on your domain:

  • ids.bro.*

Open alert pack 

Once you have installed the desired alerts individually, you can use the Open button at the top right of the card in Exchange to access the Alert configuration, where you can apply filters to find them and later manage them as required. You can also access this area via the Navigation pane (Administration → Alert Configuration → Available alerts).

Platform alert packs (use alert pack).png

Use alert pack 

The alerts installed are deactivated by default. Access the Alert configuration area to activate those you need and assign sending policies to receive them through the desired channels.