[Dshield] help identify IIS log entry

Johannes Ullrich jullrich at euclidian.com
Wed Mar 26 01:56:46 GMT 2003


> Perhaps the email address could classify them, perhaps it'd be different
> email addresses for different attacks (e.g. redalert at dshield.org,
> iiswebdav at dshield.org, etc.) - that depends on what Johannes wants to
> do.

For now, and to get started on this, lets just send logs to 'webdav at dshield.org'. I will not add them to a database, but just use
a couple grep scripts to get them organized. IIS or Apache logs are
fine.




-- 
--------------------------------------------------------------------
jullrich at euclidian.com             Collaborative Intrusion Detection
                                         join http://www.dshield.org



More information about the list mailing list