NetworkICE BlackIce Defender

["Quattrocchi, Michael" <Michael.Quattrocchi () compaq com>]

Hello All :

If anyone on the list is interested, I have written a small 
Active Server Page which will parse the attack list on the fly from
NetworkICE's BlackIce Defender product and display it as a web page.
It also generates hyperlinks for each event, allowing easy researching from
NetworkICE's incident database for each type of attack as it is found in
your log
(similar to clicking the "AdvICE" button for a given event inside BlackIce
Defender).

Being an ASP page, it will operate quite nicely on Microsoft's Personal Web
Server or
Internet Information Server. I have NOT tested it on that variant of Apache
running
ASP extensions; also, for purists, I am working on a PERL version of the
same page
so that people running Apache/Win32 locally, or a *nix version of apache on
a separate
networked system, could still interpret the attack list on the fly for
remote viewing of
the firewall logs.

I am still cleaning up the code for user friendliness; If anyone is
interested in this little
page I threw together in VBScript to teach myself ASP a few months back,
send me an email 
PRIVATELY and I will attempt to forward more information in a few days. 

thanks;
Michael

[my opinions are my own, and do not reflect those of my employer]

> -----Original Message-----
> From: Mark.Teicher () predictive com [mailto:Mark.Teicher () predictive com]
> Sent: Saturday, May 06, 2000 10:03 AM
> To: Marcus J. Ranum
> Cc: firewall-wizards () nfr net; kevbarb
> Subject: Re: [fw-wiz] B.O.F. -reply
>
>
> BFR 2.0, in my mind, should be a combination a Honeypot 
> (ability to enable 
> service stubs (i.e. Fake Telnet, ftp, http, etc) as it does 
> today, and the 
> ability to detect similiar vulnerability attacks like 
> NetworkICE BlackICE 
> Defender.

[ snip! ]

> A reporting feature with print or HTML ability would be also 
> very nice...
>
> "Marcus J. Ranum" <mjr () nfr net>
> Sent by: owner-firewall-wizards () lists nfr net
> 05/04/00 02:48 PM
> Please respond to "Marcus J. Ranum"
>
>  
>         To:     kevbarb <kevbarb () mediaone net>
>         cc:     firewall-wizards () nfr net
>         Subject:        Re: [fw-wiz] B.O.F.
>
>
>
>
> kevbarb wrote:
>
> > WHEN, OH WHEN is nfr going to come out with 2.0?
>
> We decided to make 2.0 a major upgrade. When it comes out, it
> will sport a whole lot more functionality and should make you pretty
> happy. I'm not allowed to discuss when it'll be out, though. ;)
>
> mjr.