Login Stats "false-positive"?

This deals with login stats... (I've not done any coding yet - just trying to hypothesize first... but will use CF queries)
I'm sure there's a way to do this but can't quite figure it. I know it's easy enough to do a database row count or add the 'number fields' in a
database column for a total, but - how to do this without getting a "false positive" as per below?
Goal: To find the name of the school with the lowest number of Teacher logins.
The LoginCounter database field is set up as a 'number field' and adds an increment of 1 each time a teacher logs in to the site. (for my counter code
to work, this field starts with a default of 1). I have a SchoolName field in the TeacherID row, associating a Teacher with a school and, currently
there are 5 schools... I don't have to do any kind of table join - all fields are in one table.
No problem with pulling a total on the total number of logins of ALL teachers in ALL schools or All teachers in THIS school and then comparing this
number between the different schools.
But I can see more than one "false positive" per the following:
Say, there are 20 TeacherID in School_01 and 40 TeacherID in School_02. And say, totaling the LoginCounter column shows a total of 30 teacher logins
for School_01 and 50 teacher logins for School_02. By just adding up the total LoginCounter per school would show that School_01 has the lowest number
of teacher logins.
However, you have to take into consideration that some teachers may have only logged in once (or rather, none)... as well as considering that, say, 15
teachers out of 20 teachers in School_01 may have logged in a total of 30 times... when, at School_02, one teacher may have logged in 35 times along
with 5 of his colleagues logging in once apiece. In this scenario School_01 still has the lowest total of loggins but School_02 actually has the poorer
score of total teacher logins.
How would I average the number of teachers per school with the total number of schools with the number of logins per teacher to
obtain an accurate count of actual teacher logins? An "over-zealous" teacher, logging in way more numerous times than other teachers would throw the
final figure off...
Is it even possible to obtain an accurate comparison the way I have the database fields set up? I guess (the way I have it set up) I can only consider the LoginCounter fields that have only a "1" (the number of teachers who have never logged in) and get an average to compare between schools. But if all the teachers in a school have logged in numerous times, I'll have to find some kind of "representative number" based on some kind of average between the number of teachers in a school and (the part I can't figure) some kind of average of each teacher's login total.
In retrospect, after re-reading this before posting... I guess I have only two things here: (1) The total number of logins per school (disregarding an
'over-zealous' teacher and, (2) a count on teachers who have never logged in, compared between schools. I just don't know if I can get an accurate
count for "Lowest Number of Logins School" if all teachers in a school have logged in numerous times... Is there a way to get some kind of average, or rather some 'representative number'  based on the number of teachers per school and each one's login total? Or, maybe each teacher's LoginCount doesn't even come into play here... (I know this sounds a bit confusing.)
- ed

Thanks for the responses, folks...
All of you are right about the LoginCounter not having to have a default of "1". I had forgotten that, when a participating school is set up, all teachers are set up with a unique "generic-basic unique login" name and password -- just to be able to login on "Training Day". They can change their name and password once they are in their admin section. Teachers who aren't there on "Training Day" are sent an email with instructions on logging in for the first time and changing their name and password. I guess what I'm saying is that, when a participating school 'comes on board', all the participating teachers are added to the database before they even start using the teacher admin section. Maybe it doesn't matter -- I just didn't want an empty or null value when each row is set up...
The login code is as follows, running on the 'validation page' upon login submit.
<cfif session.status IS "valid">
<cfoutput QUERY="getuser">
<cfif #LastLoginDate# NEQ #TodaysDateTime#>
    <cfset #newcount# = LoginCounter + 1>
    <cfquery datasource="#application.dsn#">
    UPDATE teacher_logon
SET
LastLoginDate=#TodaysDateTime#,
LoginCounter=#newcount#
WHERE AdminID = #AminID#
</cfquery>
<cflocation url="Teacher/index.cfm?TeacherID=#AdminID#" addtoken="Yes">
</cfif>
</cfoutput>
So... "0" + "1" = "1" ... I just wasn't sure, when I wrote the code, if this field could be left blank ("blank" + "1")... so, when the individual's row is first entered I put a default "1" here -- since, for training purposes they are already set up to go into the admin section with a pre-created name and password. I figured I could always subtract "1" from the individual's LoginCounter field for accuracy.
I think 12Roberts login ratio is probably what I'm looking for -- Login Ratio: A = total number of teachers and Z = teachers who have never logged in...... Login Ratio = A-Z. (In my existing case a field value of "1" would equal a teacher who has never logged in and a field value of "2" would be a teacher who has logged in once.) I know, I know -- Why don't I just make it complicated or something, LOL.)
I think I was over-blowing my question and 12Robots simple Login Ration is what I was looking. Thanks, 12Robots and, thanks to all for the input. I'm going to mark this post as 'solved' since, the way I have this set up, this ratio is about all I can do with a "lowest login school count".
Thanks again, folks...
- ed

Similar Messages

  • LMS 4.2.2 DFM still not possible to disable Duplicate IP false positives?

    I found one discussion about Cisco Works 2.6 where it is pointed out that duplicate IP alerts cannot be disabled in LMS.
    Now I have a installation with 2 core switches, one has all VLAN Interfaces up, the second one the same interfaces with SAME IP addresses in shutdown state.
    DFM still recognizes these similar IP configuration on two boxes as duplicate ip situation, but it shouldn't because they are all shutdown.
    Is it possible to disable these false positives in DFM?
    Thanks for any hints!

    I found one discussion about Cisco Works 2.6 where it is pointed out that duplicate IP alerts cannot be disabled in LMS.
    Now I have a installation with 2 core switches, one has all VLAN Interfaces up, the second one the same interfaces with SAME IP addresses in shutdown state.
    DFM still recognizes these similar IP configuration on two boxes as duplicate ip situation, but it shouldn't because they are all shutdown.
    Is it possible to disable these false positives in DFM?
    Thanks for any hints!

  • GRC 10 ALERT MONITOR: FALSE/POSITIVES BIAS CALL TRANSACTION

    Hi, everybody. I had an Issue related with GRC AC 10 alert monitor that is reporting that some users triggered SoD risks TR54 , TR01 and TR03 originated by transactions: ML81N - service entry against purchase order and FB05 - post with clearing. Both transactions are not available for those users because they don´t have the authorization profiles in the UMR or available in dialog mode.
    Nevertheless we observed that both actions (ML81N and FB05) were invoked by a "CALL TRANSACTION" instruction from another program report.
    I believe that this is a false positive alarm that were triggered even though the users have not assigned roles or functions of risk.
    I will appreciate your comments.
    Best Regards.
    Victor Sarabia
    IT GRC Manager

    1) How do I not alert on first failure but initiate an immediate retry in 30 seconds and if retry fails then alert.  This prevents false positives and is a feature that products such as uptrends performs as default
    SCOM has no that kind of feature
    2) How do I alert on with just one alert of transaction failure instead of each of the components of the transaction monitor failure.  Example our first failure threw 10 alerts encompassing each part of the transaction
    a) Right click web application transaction Monitoring object --> View Management Pack Object --> View Monitors
    b) Expanse the web application transaction monitor --> entity Health --> Availability --> Web Application XXXX
    c) Open the monitor properties of Request X -XXX and uncheck "Generate alerts for this monitor"
    3) How do I create an uptime report to show monthly and quarterly uptime for the website based on the transaction monitoring.
    a) go to Monitoring workspace --> Web Application Transaction Monitoring --> Web Application State
    b) select the web application transaction entity and click Availability Report task on task pane
    c) Select the report period and run
    Roger
    Roger

  • SCOM 2012 and NAP 802.1X Enforcement - Event ID: 6276 during client startup - False positive

    Hi
    We are running SCOM 2012 and we are using NAP 802.1X enforcement with HP IDM. We are getting multiple event ID: 6276's entries in SCOM during computer start-up, which is false positives as it seems the computer is put into the Non-Compliant network until
    its true state is reported. Is there a way to suspend these events, in order for us to only receive valid Non-Compliant events?
    Regards, Francois
    Francois Vorster

    Hi,
    You can make dot3svc dependent on NAP agent so that NAP agent starts up completely before the first 802.1X authentication attempt is tried. This should reduce the number of re-authentication attempts.
    -Greg

  • False positive KB2478662 after Server Cleanup Wizard

    This morning WSUS gave me false positives for several clients.  I've seen FPs before, but I've never discovered what causes them.  In fact, I'm finding it hard to even ask a useful question.
    On Friday I ran the WSUS Cleanup Wizard.  On Monday I found that our Server 2008 R2 box and all but two of our Windows 7 boxes report as needing .NET update KB2478662 - a long-superseded update from 2011.
    I ran "wmic qfe list" to learn that neither KB2478662 nor its two superseding patches (KB2633873 and KB2539635) were installed on any of the unhappy clients.  However, KB2972100 supersedes KB2633873 and KB2539635 (but not the earlier KB2478662),
    and is installed on all the clients involved.  KB2972100 is not listed as superseding KB2478662, the earliest in the chain, so it appears this sort of leapfrogging supersession may not be detected well by WSUS.
    However: KB2972100 was installed two months ago, and KB2478662 didn't show before Friday; according to the Microsoft Catalog, none of the update packages has been updated recently; and I'm not finding reports from other admins of the ghost of KB2478662 emerging
    from the shadows.  I can only assume that running the Cleanup Wizard Friday somehow left WSUS in a state where this false positive could result.
    Like I said, I can't decide what question to ask.  Am I likely correct in blaming the Cleanup Wizard?  If so, is there some way of cleaning up after the wizard?  Or of preventing this sort of false positive in the first place?  Or is there
    some other common cause for this sort of FP?
    I seem to get two or three of these FPs a year, and I always end up researching the chain of superseding updates, manually scanning clients until I'm sure the latest update is really in place - and then I decline the false positive.  But I'd love to know
    a better way to handle these, or to avoid them.

    so I don't have a years-long database of approved updates.
    That remains to be seen. It only takes one hour of overambitious update approvals to generate five years of content on a WSUS server. :-)
    KB2478662 has never appeared before
    KB2478662 is an update contained in MS11-039 and has existed since June, 2011. If your WSUS server is only a couple of months old, I'm pretty confident in stating that KB2478662 was part of your original synchronization. KB247862 (MS11-039) is not a superseded
    update.
    It's much more likely that you just did not notice it before.. but it's always been there.
    (as I noted, KB2972100 was broadly installed in October) and has never had any approvals at all.
    I can't speak to the question of approvals, but if it was broadly installed, then I'd guess that  happened before you deployed this WSUS server and those updates were installed as a result of Automatic Updates. Given that it was released on Oct 14th,
    that makes perfect sense.
    I've never had the opportunity to decline it, because it's never appeared as "needed".
    Those two statements are totally noncongruent. You don't decline an update because it is or is not needed, or was or was not ever reported as needed, you decline an update because it will **NEVER** be needed again at all.
    None of the four updates I mention came out since I installed WSUS.
    Correct, but not really relevant.
    KB2478662 (MS11-039, Jun 2011) - already explained. NOT superseded, except for ITANIUM systems, which was superseded by MS11-069.
    KB2539635 (MS11-069, Aug 2011) - SUPERSEDED by KB2633873 (MS12-016, Feb 2012), KB2604115 (MS12-035, May 2012), KB2729452 (MS12-074, Nov 2012), KB2742599 (MS13-004, Jan 2013), and KB2972100 (MS14-057, Oct 2014).
    KB2633873 (MS12-016, Feb 2012) - SUPERSEDED by KB2604115 (MS12-035, May 2012), KB2729452 (MS12-074, Nov 2012), KB2742599 (MS13-004, Jan 2013), and KB2972100 (MS14-057, Oct 2014).
    KB2972100 (MS14-057, Oct 2014) - The *CURRENT* update.
    So since they all came out before you installed WSUS that means that ALL of them were ON your server the day you installed it, and TWO of them were relevant from Day One. The other two should have been immediately declined if KB2972100 was reported as 100%
    NotApplicable.
    If WSUS thinks KB2478662 is superseded, I have no idea why the Cleanup Wizard hasn't already handled it.
    There's no "think" about it. Either the update is superseded, or it is not, and whether it's superseded and what supersedes it and what it supersedes is displayed in the Update Details in the WSUS console. One need only read the screen to get the
    facts. In this case KB2478662 is NOT superseded (unless you have an Itanium server), and nothing "thinks" that it is (except you).
    As for why the Server Cleanup Wizard hasn't dealt with it, one need only understand what the Server Cleanup Wizard DOES do with superseded updates. Superseded updates are declined *IF* (and only IF):
    The update is superseded and has not been approved for at least 30 days.
    The update is superseded and not needed by any client systems or downstream servers.
    The update is superseded and the superseding update is APPROVED.
    So... the ITANIUM instance of KB2478662 will not be handled by the Server Cleanup Wizard, because you have likely not approved any ITANIUM updates that supersede it. And the other instances of KB2478662 will not be handled by the Server Cleanup Wizard because
    they are not superseded.
    So, back to your original message.
    KB2478662 WILL be "Needed" on any system where it is NOT installed, because this update is NOT superseded. Your original premise that this update is superseded is the root of all confusion.
    Furthermore, neither KB2633873 nor KB2539635 superseded that package, but they are superseded by a newer update (KB2972100) which predates the existence of your WSUS server, so the presence of KB2972100 and the absence of BK2633873 and KB2539635 is 100%
    normal and expected.
    You were correct in noting that KB2972100 does not supersede KB2478662, but that's the point at which your logic broke down and asking yourself how 'D' supersedes 'C' and 'B', and 'C' and 'B' supersede 'A', but 'D' does not supersede 'A' might have led to
    a re-evaluation of your conclusions.
    Ergo... there are *NO* false positives. What is reported is FACTUAL.
    HINT: (I've written this over a hundred times in the past five years).... The question you should be asking in such situations is NOT "What's wrong with the update?", but rather "What's wrong with the client?" or "What's wrong with
    my analysis?" The WUA evaluates applicability based on a defined set of rules, and reports the update status to the WSUS server based on the evaluation of those rules. If the update is more than a week old.. I absolutely PROMISE you that there is *NOTHING*
    wrong with the detection logic in that update and you need to focus your investigation on things other than the updates.
    As for how to handle superseded updates and update approvals, you may find some benefit from this article:
    Removing unneeded update approvals
    Lawrence Garvin, M.S., MCSA, MCITP:EA, MCDBA
    SolarWinds Head Geek
    Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2014)
    My MVP Profile: http://mvp.microsoft.com/en-us/mvp/Lawrence%20R%20Garvin-32101
    http://www.solarwinds.com/gotmicrosoft
    The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.

  • How can you distinguish a 'false positive'?

    The IPS generated an alert, SMB Remote Registry Access Attempt. How to investigate the alert? I ran a couple of spyware programs on the host and found some cookies-generaly clean. At what point is the alert resigned as a false positive?
    “Triggers when a client attempts to access the registry on the Windows server. Microsoft tools like REGEDIT provide the ability to access a servers registry over the network. There are several hacking tools that also provide similar capabilities. Every attempted access will cause an alarm to be sent. An attacker can cause serious damage to a computer system by changing the registry.”
    appInstanceId: 403
    signature: description=SMB Remote Registry Access Attempt id=5579 version=S264
    subsigId: 1
    marsCategory: Probe/Host/WinRegistry

    You should start by looking for documented benign triggers:
    https://intellishield.cisco.com/security/alertmanager/ipsSignature?signatureId=5579&signatureSubId=0
    In this case, the benign triggers should tell you what you need to know.

  • Cellular signal becomes false positive

    Everything works fine, except after a while the cellular signal becomes a false positive. By this I mean the upper left corner continue to read "Verizon 4G LTE" with a few bars, but there's actually no signal. All apps that require the Internet doesn't work. It's an easy fix though — in Settings, the Cellular Data has to be turned off, then turned back on. And by "after a while" I mean when it falls into sleep mode after a FaceTime session, then awoken. Not sure exactly how long afterwards. Not sure if it's consistently after one nap or longer. Not sure if running other apps would do the same thing.
    Question is:
    Is this normal?
    I can imagine the upside is that you don't waste data in a prepaid data plan like when background apps continue to run.
    The dreadful downside, however, is that any incoming FaceTime call cannot get through.
    If this is NOT normal, is it a common glitch/bug/quirk? And how to fix it?
    iPad3, OS 6.0.1

    You can't begin measuring velocity until it is positive unless you have already been measuring velocity.
    The solution is to always do the measurement.  Evaluate it with a >0.  In the true condition, then do whatever it is you want to do.

  • False Positives with GRC AC 5.2

    Hi,
    I actually have been working with GRC AC 5.2 (Compliance Calibrator) and we encountered several problems with false positives, working in the risk analysis.
    ¿do anyone knows how to solve this problem? ¿do you have documents or links to help?
    Thanks,
    Ricardo.

    Thank you Alpesh for response.
    In fact, i have several problem with false positives, but with transactional level. For example, i have a user with pfcg and su01 transaction. The configutation of profiles in SAP r/3 system do not allow to user involved in this, to execute both transactions in end-to-end process, i mean, the user have a transaction vía s_tcode object, have some other objects related with pfcg and su01 transactions, but he doesn´t have the values that allow to a transactions work properly. Then the Compliance Calibrator informs risks that it doesn´t exists.
    It seems that is a ruleset configuration problem in the CC, then my question is, ¿the standard ruleset detects properly these problems?
    Let my explain the reason that causes the problem.
    We have been working with personalized ruleset, for customer-request. For that reason we look the usobt_c table and we form the ruleset-->functions in CC so that this functions were equal to usobt_c table. We did that because the standard ruleset shows false positives, such as first example of this post.
    Thank you very much,
    RCL.
    Edited by: Ricardo  Carrasco on Jun 18, 2009 11:58 PM

  • Comparing documents and false positives

    Hello,
    I often have to send a proof of a book to a printer. The proof is a PDF. When they return a soft proof--another PDF that they will use to print--I need to quickly compare the two to make sure that there have been no changes in the text.
    The Compare Documents feature certainly beats a side-by-side eyeball scan. But I often get a lot of false positives, words are flagged that actually have not changed.
    It appears that my PDF, exported from InDesign has some hidden discretionary hyphens. In ID these are used to make sure a word breaks at the end of the line at the correct syllable. They are invisible when printed. In a PDF these are not necessary because the text ain't gonna reflow, right?
    But when I compare the soft proof to the original PDF, words with discretionary hyphens are flagged. Somehow the printer has stripped the discretionary hyphens. That's fine but what must I do to get rid of them in my PDF?
    Below is an example. The PDF shown is the one from the printer. The comment box shows the difference from the original PDF, though there is in fact no difference on the page.
    Any advice would be appreciated.
    Tom

    I like Acrobat's text comparisons, which have saved me from bad goofs several times -- mostly stray key-strokes, but once I caught an InDesign footnote numbering snafu.  However, the false positives have always been annoying even without flagging every single discretionary hyphen.
    I imagine you have tried the image method for comparisons, a modern version of the old trick of putting printouts of the old and new versions of a page on a light table to find differences.
    I don't recall seeing comments of the type "undefined", but does re-sorting comments by type at least isolate these so you can step through the rest?  I'm no scripter, but can a javascript mark or eliminate comments containing hyphens?
    More drastic, would it be worth trying to eliminate the discretionary hyphens?  For instance, you could apply Harb's "Freeze Composition" in InDesign, and then search-and-replace all discretionary hyphens.  (Read the comments on the In-Tools site, as well as those in the InDesignSecrets blog it links to because you might want to modify the way it handles hyphens.)
    Good luck!
    David

  • False Positives for id=12713 version=S149

    Just started receiving numerous firings of 12713. Looks like false positives. Is anyone else observing this?
    Cisco MARS is creating the following : System Rule: DoS: Network - Success Likely
    thanks
    John Stark

    This is indeed a false positive. You can either filter out trusted hosts or create a metasignature using this signature as a component to reduce the chance of false positives.
    Tune signature 3327-6 and remove the produce alert action.
    Create a custom signature as follows:
    Engine Meta
    Component list:
    3327-6
    3328-0
    Meta-reset-interval = 2
    Severity high
    Summarize
    Met-key = Axxx – 1 unique victim
    Component-list-in order = false
    Event action: produce alert
    This signature will only fire when signatures 3327-6 and 3328-0 fire. Since 3327-6 would have no event action of its own you would not see alerts from it.
    Note that this signature does not have as high fidelity as the original 3327-6, that being said signature 3327-0 detects almost all public exploits for this vulnerability. We will note this in the NSDB.

  • Pvc2300: false positive with motion detection

    Hello!
    I bought 3 pvc 2300 cameras. I tried motion detection with camera's software and with "Active webcam" software and I received a lot of false positive mails.
    1. with camera's software, I set event with motion detection & sent mail, but I receive a lot of mail when there isn't motion (I saw registrations and images)
    2. with Active WebCam software I use Linksys cameras and Panasonic Cameras. With Panasonic cameras all is ok. With Linksys cameras, about every hours there is a black frame, so I receive a mail from motion detection. Black frame arrive about every hours, after 60 minutes from last black frame. That is very strange!
    I changed sensitivity, check frequency, number of frame at second, but I have same problem.
    Can you help me?
    Thanks
    Mary

    I have 2 Panasonic cameras too and I need one software to manage all cameras.
    sensitivity: on active webcam software, I changed sensitivity of motion detection
    frequency check: on active webcam software, I changed from check motion every 0,1 second to every 5 seconds
    number of frame: on Linksys software I changed Max Frame Rate from 15 fps to 6 fps.

  • Possible false positive issue with SigID 3353

    Here is a packet captured by the IDS that triggered SigID 3353 - SMB Request Overflow
    evAlert: eventId=1075708170032493259 severity=high
    originator:
    hostId: cisco-ids-v4.1
    appName: sensorApp
    appInstanceId: 1134
    time: 2005/07/18 14:53:30 2005/07/18 14:53:30 UTC
    interfaceGroup: 0
    vlan: 0
    signature: sigId=3353 sigName=SMB Request Overflow subSigId=0 version=S180 Malformed SMB Request
    context:
    fromVictim:
    000000 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 ................
    000010 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 ................
    000020 01 00 00 00 00 00 00 00 00 00 00 68 FF 53 4D 42 ...........h.SMB
    000030 25 00 00 00 00 98 07 C8 00 00 00 00 00 00 00 00 %...............
    000040 00 00 00 00 00 50 78 07 01 90 81 0C 0A 00 00 30 .....Px........0
    000050 00 00 00 00 00 38 00 00 00 30 00 38 00 00 00 00 .....8...0.8....
    000060 00 31 00 2C 05 00 02 03 10 00 00 00 30 00 00 00 .1.,........0...
    000070 0A 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 ................
    000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    000090 00 00 00 00 00 00 00 68 FF 53 4D 42 25 00 00 00 .......h.SMB%...
    0000A0 00 98 07 C8 00 00 00 00 00 00 00 00 00 00 00 00 ................
    0000B0 00 50 78 07 01 90 C1 0C 0A 00 00 30 00 00 00 00 .Px........0....
    0000C0 00 38 00 00 00 30 00 38 00 00 00 00 00 31 00 2C .8...0.8.....1.,
    0000D0 05 00 02 03 10 00 00 00 30 00 00 00 0B 00 00 00 ........0.......
    0000E0 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    0000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    fromAttacker:
    000000 00 00 00 00 00 54 00 2C 00 54 00 02 00 26 00 0F .....T.,.T...&..
    000010 70 3D 00 00 5C 00 50 00 49 00 50 00 45 00 5C 00 p=..\.P.I.P.E.\.
    000020 00 00 00 00 05 00 00 03 10 00 00 00 2C 00 00 00 ............,...
    000030 0A 00 00 00 14 00 00 00 00 00 01 00 00 00 00 00 ................
    000040 BB E2 9E 20 19 4C 0D 4B B7 17 DF 44 B9 00 52 40 ... .L.K...D..R@
    000050 00 00 00 80 FF 53 4D 42 25 00 00 00 00 18 07 C8 .....SMB%.......
    000060 00 00 00 00 00 00 00 00 00 00 00 00 00 50 78 07 .............Px.
    000070 01 90 C1 0C 10 00 00 2C 00 00 00 54 05 00 00 00 .......,...T....
    000080 00 00 00 00 00 00 00 00 00 54 00 2C 00 54 00 02 .........T.,.T..
    000090 00 26 00 0F 70 3D 00 00 5C 00 50 00 49 00 50 00 .&..p=..\.P.I.P.
    0000A0 45 00 5C 00 00 00 00 00 05 00 00 03 10 00 00 00 E.\.............
    0000B0 2C 00 00 00 0B 00 00 00 14 00 00 00 00 00 01 00 ,...............
    0000C0 00 00 00 00 15 FD E7 ED 7D DD E4 40 8A E9 7C 39 ........}..@..|9
    0000D0 30 15 BC C3 00 00 00 80 FF 53 4D 42 25 00 00 00 0........SMB%...
    0000E0 00 18 07 C8 00 00 00 00 00 00 00 00 00 00 00 00 ................
    0000F0 00 50 F0 06 01 90 00 0D 10 00 00 2C 00 00 00 80 .P.........,....
    participants:
    attack:
    attacker: proxy=false
    addr: locality=IN 10.24.238.193
    port: 1071
    victim:
    addr: locality=IN 10.24.4.42
    port: 139
    alertDetails: Traffic Source: int0 ;
    As you can see, looks like a pretty normal SMB packet. This sensor is on an internal network, so Windows file and printer sharing is the norm.
    I think there is a false positive issue that was introduced with the signature’s tuning via the S180 update. As a result, I have two questions:
    1) Am I right, or is the signature working as it should?
    2) Is anyone else having this problem?
    Any and all feedback will be greatly appreciated,
    Alex Arndt

    The new version of this signature should be included in the S182 update. As a workaround if you are using 5.x you may to create 2 meta signatures using this signature and the no-op sled signatures (3328 for better coverage create a meta associated with each one and the existing sig). In your component list be sure to set 3353 prior to 3328. Set unique attackers to 1, meta interval to 2, and component list in order to true. This should eliminate all benign triggers.

  • How to determine is it SMB - Remote SAM server access , false positive?

    How to determine is it SMB - Remote SAM server access , false positive?

    5583-0 right?
    I would say that there are different types of false positives. Do you mean, how do I determine if what what was seen actually represents an attempt to access the SAM database? I would start by looking at MySDN (or whatever Cisco is calling it these days...intellishield?). It's often not very up to date and missing information, but it's an easy thing to check. Here's the link for this sig:
    https://intellishield.cisco.com/security/alertmanager/ipsSignature?signatureId=5583&signatureSubId=0
    If you look at the benign triggers, you'll see that it suggests that this only matters if the source is external. It's up to you whether to research any further. If you really want to inspect the signature further, you'll have to add one of the "log packets" actions. This will save a network trace when it fires again and then you can open it up in Wireshark, which understands SMB and will probably decode it enough for you to verify whether it actually was an attempt to access the "Remote SAM server".

  • Extensions.checkCompatibility.17.0 does not stay in false position

    After updating from 16 to 17 some of the extensions that are crucial for me stopped working, got disabled and got listed as incompatible with 17.0. Now when I try to toggle the extensions.checkCompatibility.17.0 boolean into the “false” position, it readjusts itself into “true” after each restart, making it impossible to force those extensions as compatible.
    Why is this happening and what can I do to make it stay at “false”?

    edit: now extensions.checkUpdateSecurity stays true but I can’t find how to access the “make compatible” option. Nightly tester tools does not seem to provide it.
    edit: nvm, issue solved by downgrading.

  • Lots of false positives on outbound SPAM filtering

    Starting around 5:30AM this morning a lot of our outbound e-mail began testing as positively identified SPAM.  In our environment I have positively identified outbound SPAM setup to go to a quarantine.
    In looking at the e-mails they are legitimate e-mails. 
    My first attempt was to lower the positively identified SPAM threshold from 75 to 50, had no effect.
    My second attempt was to exclude our internal domains so that e-mail hitting our IronPort appliances for internal recipients would be allowed through, positively identified SPAM or not.
    EDIT:  Reviewing some of the e-mails, some are a simple e-mail with text only and a single .pdf attachment.  Tested as positively identified SPAM.  Some have multiple hyper links but are to legitimate URLs.
    My questions:
    What changed this morning that is causing all of these false positives?
    What can I do differently to not let this occur again?
    Thanks...

    Really appreciate the replies...
    Bob, SBRS is disabled on my outbound mail and it also comes from private/internal IP addresses, does show "not enabled" in message tracking...
    After my post this morning our appliances (two C660s) were still false positiving a lot of outbound mail that was for external recipients (my filter was excluding internal domains)..  but after 1:00PM central or so they started declining and since 3:00PM there hasn't been a single one..   Could be the volume of e-mail is starting to go down a little but I'm guessing there was a CASE rules update...
    Now I just need to decide if I'm going to set the SPAM threshold back to what it was or just leave it alone..  We have had a problem with internal users getting their mail accounts compromised and send out a lot of phishing e-mails that I have been trying to block.

Maybe you are looking for

  • Exchange rate differecen to be posted to different WBS in forex p/o

    Dear Friends, Pls note my client hv budget allocations in WBS & thru this only the procurement activities are happening. In case of import p/o the exchange rate is displayed by default when you enter the date but when the G/R-IR happens the exchange

  • Strange init serial port issue

    Hello: My Labview application is reading data from the COM1..COM6 ports (I have added a MOXA serial board to get 4 more ports). I am using RS232 reading on each port (old legacy Vis, 9m long communication cables). The devices to which I am connected

  • Is Oracle 8i Client installed?

    What's the best way for a setup program to find out if Oracle 8i client is installed on a machine? Is there a specific registry key or file I can look for? I also need to get the Home name and Path. Thanks, Tom Jordan

  • How can one make his own mini 5-din MIDI cab

    Dear all, I'm stuck with quite a problem over here. Bought an Audigy 2 Platinum a couple of months ago through the Internet and it works like a gem, but................if I want to hook up my soundmodule to it, I'm confronted with the fact that I nee

  • Adobe flash sous machine virtuelle: petit souci

    Hello, j'ai adobe flash CS4 (photoshop, illustrator et indesign de même) sous machine virtuelle (je tourne sous linux) Je n'ai aucun souci avec les outils, sauf UN, et pas des moindres Il s'agit de l'outil transformation libre, mais dans un cas bien