[Dshield] ThreatCon Indicator

Jim McCullough jim.mccullough at gmail.com
Tue Dec 20 03:39:05 GMT 2005


There is an RSS feed that generates the ThreatCon section for Symantec.
It's burried in some archived documents.  I fired up a script to start
digging.  However, it might take a while.... 3 gigs of bzip2 -9 archives
takes a little work for this poor 750 P3.  But I do have the docs on it
in there.  Unless my wife dumped it out /dev/null.

Jim McCullough
(animall)

On Mon, 2005-12-19 at 16:34 +0000, stu wrote:
> I'd make a C# App that every hour pulls the Symantec page, does a string
> search for the threatcon_1.jpg, or threatcon_2.jpg then if it finds 1
> copy c:\symanpics\threat1.jpg to c:\inetpub\wwwroot\images\thread.jpg
> 
> And if it finds 2 copy thread2.jpg instead.
> 
> Just how I'd do it. 
> 
> Stu
> 
> -----Original Message-----
> From: list-bounces at lists.dshield.org
> [mailto:list-bounces at lists.dshield.org] On Behalf Of Mark Brunner
> Sent: 19 December 2005 15:39
> To: 'General DShield Discussion List'
> Subject: Re: [Dshield] ThreatCon Indicator
> 
> No, I have attached the 3 images that make up the alert.
> Problem is, the center part, the actual alert level, is not named
> something
> like "threatcon.jpg".  Instead it is given a trailing 1_ani or 2_ani.
> If
> Symantec or Security Focus had just copied the graphic to their webpage
> always using the same name, it would be so simple.  Then no matter what
> the
> threat level, the graphic's name would be the same, and all I would have
> to
> do is reference that single graphic with a remote image tag on the
> webpage...
> 
> Cheers!
> Mark
> 
> -----Original Message-----
> From: list-bounces at lists.dshield.org
> [mailto:list-bounces at lists.dshield.org]On Behalf Of J Lake
> Sent: Monday, December 19, 2005 9:39 AM
> To: General DShield Discussion List
> Subject: Re: [Dshield] ThreatCon Indicator
> 
> 
> On Monday 19 December 2005 07:24 am, Joel Esler wrote:
> > There is a place somewhere on there.  You can get the threat list, the
> > top 5 viruses..  5 newest.  I don't know where it's at, but I have
> > seen it on several sites.
> >
> > Joel
> 
> 
> Mr. Esler -
> Is it this one?
> http://www.sarc.com/avcenter/
> 
> _________________________________________
> Learn about Intrusion Detection in Depth from the comfort of your own
> couch:
> https://www.sans.org/athome/details.php?id=1341&d=1
> 
> _______________________________________________
> send all posts to list at lists.dshield.org
> To change your subscription options (or unsubscribe), see:
> http://www.dshield.org/mailman/listinfo/list
> 
> _________________________________________
> Learn about Intrusion Detection in Depth from the comfort of your own couch:
> https://www.sans.org/athome/details.php?id=1341&d=1
> 
> _______________________________________________
> send all posts to list at lists.dshield.org
> To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list



More information about the list mailing list