What metrics make up the number Total scanned under Network Attacks Exceutive summary

rczarneckirczarnecki
in Firebox - Other

I am trying to understand this information. See image
https://photos.app.goo.gl/ogoNJkBryU12JxEK9

Should the total scanned be the sum of Intrusion prevention, Geolocation, Reputation Enabled Defense, and botnet detection?

Is this all packets scans of protocols, including HTTP, HTTPS, FTP, TCP, UDP, DNS, SMTP, POP3, etc to block network, application, and protocol-based attacks?

Thanks

Answers

  • Bruce_BriggsBruce_Briggs

    Botnet detection & Geo are looking at an IP addr - I assume of a session initiation packet.
    RED is looking up a domain name for a HTTP/HTTPS session.
    Intrusion detection depends on the signatures used for the inspection - they can be for many packet types, many of the sigs are for web related access, but there are lots of others including DNS, email attachments etc.

Sign In to comment.