Visitor rules

It is possible for KFSensor to react differently depending on the IP address of a visitor and to the number of connections made each visitor.
Each scenario can contain an unlimited number of rules which define actions to take.

The rules are defined using the Visitor Rule dialog box which can be accessed by the Rules button in the Edit Scenario dialog or the Edit Active Visitor Rules menu option in the Scenario Menu.

Rule conditions

A rule is triggered if its conditions are met.
Each rule can have the following conditions defined; a host DNS name, an IP address or IP address range, the transport protocol and the sensor port number. An optional range for the number of connections made to the specified port can also be set.

When a connection occurs that meets the conditions of several rules then KFSensor will pick one rule.
The rule with the most specific conditions will be chosen according to the following priorities:

• A rule with a host DNS name will always have priority over a rule with an IP range.
• A rule with a single IP will always have priority over a rule with an IP range.
• A rule with a specific port will have priority over a rule which applies to all ports.
• A rule with a specific protocol will have priority over a rule which applies to all protocols.

Rule actions

1. Close

2. Ignore

3. Set Severity

How rules can be used

1. Increase severity for internal attacks

Attacks originating from inside the organization can be considered more severe than those from the Internet.

2. Ignore legitimate traffic

A trusted machine may be generating SQL Server broadcast messages. Events from this machine to port 1434 can be ignored with this rule.

3. Hide from vulnerability scanners

If vulnerability scanners are being used as part of a security audit then they will generate alerts on KFSensor and on the scanner itself. A rule can be used to get KFSensor not to respond to specified IP address.

4. Only log the first three events

Some visitors can make a very large number of connections to a particular port. This practical example uses a rule to control the actions taken for a visitor that makes repeated connections to UDP port 137, the NBT name service. Only the first three connections will be logged.

In the case of UDP 137 it is also useful to specify a separate max connection limit for this port. See the Edit Listen dialog for more details.

Next: Signatures

KF Sensor On-Line Manual Contents