How to list source and destination IP for alerts suppressed by alert throttling

技術的な記事 ID: KB85438
最終更新: 6/11/2020

環境

McAfee Network Security Manager (NSM) 10.x, 9.x

概要

To list source and destination IP for alerts that alert throttling suppressed, perform the following steps. In the example in the steps, the query lists all alerts for the attack ID 0x40207e00, signature HTTP: IIS CMD.exe Execution.

Open a command prompt session on the NSM.
Type the following command and press Enter:

mysql -uroot -p lf
Type your root password.

Type the following query with the appropriate attack ID and press Enter:

select attackIdRef, inet_ntoa(conv(sourceIPAddr,16,10)), inet_ntoa(conv(targetIPAddr,16,10)) from iv_alert where attackIdRef='<attack ID>' AND creationtime between now() - interval 1 month and now();

For example:
select attackIdRef, inet_ntoa(conv(sourceIPAddr,16,10)), inet_ntoa(conv(targetIPAddr,16,10)) from iv_alert where attackIdRef='0x40207e00' AND creationtime between now() - interval 1 month and now();

You see output similar to the following:

    +-------------+-------------------------------------+-------------------------------------+

    | attackIdRef | inet_ntoa(conv(sourceIPAddr,16,10)) | inet_ntoa(conv(targetIPAddr,16,10)) |

    +-------------+-------------------------------------+-------------------------------------+

    | 0x40207e00  | 192.168.1.10                        | xxx.xxx.xxx.xxx                     |

    | 0x40207e00  | 192.168.1.99                        | 192.168.1.14                        |

    | 0x40207e00  | 192.168.1.99                        | 192.168.1.14                        |

    | 0x40207e00  | 192.168.1.99                        | 192.168.1.14                        |

    | 0x40207e00  | 192.168.1.99                        | 192.168.1.14                        |

    | 0x40207e00  | 192.168.1.99                        | 192.168.1.14                        |

    | 0x40207e00  | 192.168.1.99                        | 192.168.1.14                        |

    | 0x40207e00  | 192.168.1.99                        | 192.168.1.14                        |

    | 0x40207e00  | 192.168.1.99                        | 192.168.1.14                        |

    | 0x40207e00  | 192.168.1.99                        | 192.168.1.14                        |

    | 0x40207e00  | 192.168.1.99                        | 192.168.1.14                        |

    +-------------+-------------------------------------+-------------------------------------+

    

    11 rows in set (0.02 sec)

影響を受ける製品

Network Security Manager 9.2.x
Network Security Manager 9.1.x
Network Security Manager 10.x

言語:

この記事は、次の言語で表示可能です:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

技術用語集

用語集にある用語をハイライトする

当社の技術用語集を参照してください。

Knowledge Center

How to list source and destination IP for alerts suppressed by alert throttling

環境

概要

影響を受ける製品

言語:

技術用語集

Title

Title

Knowledge Center

How to list source and destination IP for alerts suppressed by alert throttling

環境

概要

影響を受ける製品

言語:

技術用語集

地域を選択してください

Title

Title