How to check Traffic flowing from Security devices to and fro BAD IP/ Malicious Sites

[aakashk1]

Hi All,

Want to know how can we check if traffic flowing from (Firewall/Proxy) to and fro contains BAD IP or Malicious site IP Address.

Thanks,

A.K

[priyamalik1]

Hi,

Steps Are:

1. First collect a malicious IP list, saved these IP's to active list

2. Create a rule which will compare these malicious IP's with your security devices event's source IP and Destination IP.

3. If any match occurred, saved those events to another active list (Rule Action).

Done 🙂

Please let me know if you want consolidated malicious IP List.

Thanks and Regards,

[aakashk1]

Hi Priya,

Thanks for your reply.

Please share the consolidated malicious IP List. Also if you can share from which Site we can get these details.

Also can you share more detailed steps for the process as I am New to Arcsight.

Thanks,

A.K

[aakashk1]

Hi Priya,

Thanks for your reply.

Please share the consolidated malicious IP List. Also if you can share from which Site we can get these details.

Also can you share more detailed steps for the process as I am New to Arcsight.

Thanks,

A.K

[varunraaj]

Hi AK,

You have a licensed component in ArcSight called "RepSM" which would fulfill your need.

To know about that component you could reach service people with your valid SAID.

Regards,

Varun P G

[aakashk1]

Hi Varun,

I have RepSM licensed installed. But its not detecting some of the malicious IP Address to and fro

Thanks & Regards,

A.K

[varunraaj · Accepted solution]

Hi Ak,

You mean to say that Malicious IP is not in the RepsM list? Or it is in list but not being used for rule ?

Regards,

Varun P G