RE: external database for Cisco IDS
From: jim terry (jtixthus@excite.com)Date: 12/20/01
- Previous message: Sébastien Vaast: "Re: Winxp, blackice and ie"
- Maybe in reply to: jim terry: "external database for Cisco IDS"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 20 Dec 2001 07:19:00 -0800 (PST) From: jim terry <jtixthus@excite.com> To: focus-ids@securityfocus.com
Hi all,
Thank you all for your responses. I will try the copy archive command as
well as the URL provided. Hopefully I will get a chance to do this over the
weekend.
I hope I did not make any waves with the post!
JT
On Wed, 19 Dec 2001 19:54:39 -0500, aarndt@canada.com wrote:
> Seasons Greetings,
>
> I don't want to appear too harsh here, but I must ask what context you're
> basing your advice WRT the FTP copy on?
>
> I know that you can configure Cisco IDS Sensors through CSPM (or UNIX
> Director's nrConfigure utility for those of us who use it) to copy their
> log files to a central logging point via FTP (using the sapd daemon), but
> I don't think that it applies to the database on the machine running
CSPM.
>
> The exact method for exporting the CSPM data escapes me now, but I sure
> that it's not via FTP. I think you have to use some sort of 'export' type
> command from the DB interface...
>
> I have some documentation (alas, not at my fingertips) that I can use to
> confirm this, but you'll have to bear with some lag time.
>
> Alex Arndt, GCIA
> "Within all order is the potential for chaos..."
>
> -----Original Message-----
> From: jim patterson [mailto:jimp@cityscape.net]
> Sent: Wednesday, December 19, 2001 5:21 PM
> To: 'jim terry'
> Cc: focus-ids@securityfocus.com
> Subject: RE: external database for Cisco IDS
>
>
> Go into the logging tab in CSPM and check the copy archived log files to
> a ftp server.
>
> -----Original Message-----
> From: jim terry [mailto:jtixthus@excite.com]
> Sent: Wednesday, December 19, 2001 2:04 PM
> To: focus-ids@securityfocus.com
> Subject: external database for Cisco IDS
>
>
> Can anyone provide a URL on how to configure Cisco Secure Policy Manager
> to send its past alarms to an external database?
>
> Thanks in advance.
>
> JT
>
>
>
>
>
> ________________________________________________________________________
> ______
> Send a friend your Buddy Card and stay in contact always with Excite
> Messenger http://messenger.excite.com
>
>
>
______________________________________________________________________________
Send a friend your Buddy Card and stay in contact always with Excite Messenger
http://messenger.excite.com
- Previous message: Sébastien Vaast: "Re: Winxp, blackice and ie"
- Maybe in reply to: jim terry: "external database for Cisco IDS"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
