2159a_08.ppt

Module 8:Monitoring and Reporting Overview Planning a Monitoring and Reporting Strategy Monitoring Intrusion Detection Monitoring ISA Server Activity Analyzing ISA Server Activity by Using Reports Monitoring Real-Time Activity Testing the ISA Server Configuration Planning a Monitoring and Reporting Strategy Monitoring Intrusion Detection IP Packet–Level Attacks Application–Level Attacks Configuring Intrusion Detection ISA Server Events Configuring Alerts Configuring Advanced Alert Properties ? IP Packet–Level Attacks All Ports Scan Attack IP Half Scan Attack Land Attack Ping of Death Attack UDP Bomb Attack Windows Out-of-Band Attack Application–Level Attacks DNS Hostname Overflow DNS Length Overflow DNS Zone Transfer from Privileged Ports (1–1024) DNS Zone Transfer from High Ports (Above 1024) POP Buffer Overflow Configuring Intrusion Detection ISA Server Alert Events Configuring Alerts Configuring Advanced Alert Properties Monitoring ISA Server Activity Configuring Logging Logging Packet Filter Activity Configuring Logging Logging Packet Filter Activity Analyzing ISA Server Activity by Using Reports Configuring Log Summaries Creating Report Jobs Using Predefined Report Formats Viewing and Saving Reports Creating Report Jobs Configuring Log Summaries Viewing and Saving Reports Viewing Reports Saving Reports Saving reports as Web pages Saving reports as an Excel workbooks Using Predefined Report Formats Monitoring Real-Time Activity Viewing and Disconnecting ISA Server Sessions Using Performance Objects Monitoring H.323 Gatekeeper Sessions Viewing and Disconnecting ISA Server Sessions Viewing Sessions Disconnecting Sessions Using Performance Objects ISA Server Bandwidth Control ISA Server Cache ISA Server Firewall Service ISA Server Packet Filter ISA Server Web Proxy Service Monitoring H.323 Gatekeeper Sessions Viewing H.323 Gatekeeper Clients Viewing Active H.323 Sessions Testing the ISA Server Configuration Using Thir