[prev in list] [next in list] [prev in thread] [next in thread] 

List:       forensics
Subject:    RE: WFA and network forensics
From:       Robert Buckley <rbuckley () synapsemail ! com>
Date:       2003-07-31 5:41:00
[Download RAW message or body]

 JJ,
Just a thought, you might want to download Websense from websense.com for a
demo. (30 days?). I know, its commercial, but may get you what you want, at
least for this situation. It can certainly monitor an individuals activety
with some degree of accuracy, and present an acceptable report.

Vericept.com has some demo products as well, I believe View is one of
interest to you.

* Doesn't matter who maintains a database of catagories, sites change
catagories at whim. This is a topic in itself...







-----Original Message-----
From: kris carlier
To: JJ
Cc: forensics@securityfocus.com
Sent: 7/29/2003 2:38 PM
Subject: Re: WFA and network forensics

>
> I'm not sure if this is the right place for this, but I'm giving it a
shot anyway.
>
> I've got web traffic logs for our users.  In a WFA case, I need to be
able to pull an individual employee's activity out of our logs and
categorize the sites visited by said soon-to-be-ex-employee by site
type.  For instance:
>
> safe-mail.net  = Web-based email
> google.com     = Search site
> foxnews.com    = News
> weather.com    = Weather
> whitehouse.com = Adult entertainment
>
> I know a lot of the filtering suites out there do this kind of
categorization, but I just need a good, often-updated category list by
domain name so that I can grab the connection request heading to an IP
and do a rough categorization based on what that IP resolves to.
>
> I also want to roll this category list into our post-WFA forensic
analysis procedures so I can give a categorized report along with the
actual system and evidence images.
>
> Any ideas?
>
> I figure this roughly fits into the kind of work some of us do, a.k.a.
> finding out what people do when they use our computers in ways that
> aren't intended.




-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

[prev in list] [next in list] [prev in thread] [next in thread]