Security Analysis Tabs*

This security analysis module is only for Capsa Enterprise edition.

Security Analysis profile is designed to detect the worm activities, TCP port scanning, ARP attacks, DoS attacks and suspicious conversations in your network. This analysis profile has all the components that Full analysis profile includes and has its own six tabs to presents you the detection results.

This analysis profile real-timely presents the detected malicious activities in your network in front of you, such as the worm infected source IP addresses, the compromised machine IP addresses and the targeted DoS attacked server address. It saves your time and efforts to do the dedicated analysis of the activities in real-time so that you can go to the troubled machines and cut off the malicious activities quickly with the results it provides you.

The dedicated tabs are listed as follows:

• ARP Attack: detects ARP attack activities including ARP scanning, ARP spoofing, ARP request storm and ARP too many unrequested response, and provides source MAC addresses to locate the infected hosts.
• Worm: detects suspicious worm activities and provides details including source IP addresses to locate the infected hosts.
• DoS Attacking: detects devices joining in a DoS attack to attack a remote site, and provides details on the devices to locate.
• DoS Attacked: detects the devices under a DoS attack and provides details on targeted devices to cut off the attack.
• TCP Port Scan: detects suspicious TCP port scanning activities and details including attacker addresses to locate the hosts.
• Suspicious Conversation: detects suspicious conversations of HTTP, FTP, SMTP and POP3, and provides details to figure out the problem.