topic Credential Guessing Event in SmartEvent in Firewall and Security Management

Credential Guessing Event in SmartEvent

Prabulingam_N1 — Mon, 09 Dec 2019 05:30:48 GMT

Dear All,

Anyone had come across on the below Events:
We have SmartEvent (Both R77.x & R80.x) in same machine of Management server.

We have enabled Event Policy - "Unauthorized Entry" - "Credential Guessing" to generate events of 3 failures within 600 Seconds.
We are receiving Events on the above as well which is fine.

But we have different info on the above "Credential Guessing" Event Log.

Example: We have Internal Server (Windows 2012) and we tried to SSH into Firewall from this Server.
For few wrong attempts as per Event Detection - we get Events.

But the Event "Product" says "Linux OS" instead of "Windows OS"

(Attached screenshot)

Regards, Prabulingam

Re: Credential Guessing Event in SmartEvent

G_W_Albrecht — Mon, 09 Dec 2019 11:09:07 GMT

Why attach a Word document instead of an image ???

Re: Credential Guessing Event in SmartEvent

G_W_Albrecht — Mon, 09 Dec 2019 11:12:38 GMT

This in fact is correct - a Linux device has reported the Credential Guessing Event in SmartEvent as GAIA is based on RedHat Linux. This does not characterize the hacker OS but the devices OS where the issue Credential Guessing occurred 8).

Re: Credential Guessing Event in SmartEvent

Prabulingam_N1 — Wed, 11 Dec 2019 04:52:45 GMT

Dear G_W_Albrecht,

Thanks for your inputs, this helps me to inform the customer for clearing on Linux OS.

Regards, Prabu