Credential Guessing Event in SmartEvent

[Prabulingam_N1]

Dear All,

Anyone had come across on the below Events:
We have SmartEvent (Both R77.x & R80.x) in same machine of Management server.

We have enabled Event Policy - "Unauthorized Entry" - "Credential Guessing" to generate events of 3 failures within 600 Seconds.
We are receiving Events on the above as well which is fine.

But we have different info on the above "Credential Guessing" Event Log.

Example: We have Internal Server (Windows 2012) and we tried to SSH into Firewall from this Server.
For few wrong attempts as per Event Detection - we get Events.

But the Event "Product" says "Linux OS" instead of "Windows OS"

(Attached screenshot)

Regards, Prabulingam

[G_W_Albrecht]

Why attach a Word document instead of an image ???

[G_W_Albrecht]

This in fact is correct - a Linux device has reported the Credential Guessing Event in SmartEvent as GAIA is based on RedHat Linux. This does not characterize the hacker OS but the devices OS where the issue Credential Guessing occurred 😎.

[Prabulingam_N1]

Dear G_W_Albrecht,

Thanks for your inputs, this helps me to inform the customer for clearing on Linux OS.

Regards, Prabu