© 2006 Cisco Systems, Inc. All rights reserved. HIPS v Using CSA Analysis Generating Behavior Analysis Reports

© 2006 Cisco Systems, Inc. All rights reserved. HIPS v Objectives At the end of this lesson, you will be able to meet these objectives: Identify the various types of behavior analysis reports Describe how to view behavior analysis reports Identify the information provided by File event reports Identify the information provided by Registry event reports Identify the information provided by COM event reports Identify the information provided by Network event reports Identify the information provided by Summary reports

© 2006 Cisco Systems, Inc. All rights reserved. HIPS v Types of Behavior Analysis Reports File event reports Registry event reports COM event reports Network event reports Summary reports

© 2006 Cisco Systems, Inc. All rights reserved. HIPS v Viewing Behavior Analysis Reports

© 2006 Cisco Systems, Inc. All rights reserved. HIPS v File Event Reports

© 2006 Cisco Systems, Inc. All rights reserved. HIPS v Registry Event Reports

© 2006 Cisco Systems, Inc. All rights reserved. HIPS v COM Event Reports

© 2006 Cisco Systems, Inc. All rights reserved. HIPS v Network Event Reports

© 2006 Cisco Systems, Inc. All rights reserved. HIPS v Summary Reports

© 2006 Cisco Systems, Inc. All rights reserved. HIPS v Summary Behavior Analysis reports are created after Behavior Analysis is performed on an application. File event reports display the information about all the events occurring in a file and its related entities. Registry event reports help in analyzing the events related to registry keys that were accessed, and the process that initiated this access event. COM event reports provide information about the process that accessed the COM component. Network event reports help an administrator keep track of the various protocols that access the network. Summary reports provide information about the overall status of the network and also include information about all the individual entities.

© 2006 Cisco Systems, Inc. All rights reserved. HIPS v