Cyber Threat Statistic

This dashboard relies on syslog messages generated by the following NFO Modules packaged in Security Module Set:

1. 10053: Threat Feeds Traffic Monitor
2. 10050: Botnet C&C Traffic Monitor
3. 10052: Host Reputation Monitor (shown in Malicious Hosts widgets)

Make sure these Modules are enabled and configured to see data in this dashboard.

Make sure these Modules are enabled and configured to see data in this dashboard. This dashboard has the following widgets.

Threat Feeds

This widget shows traffic to and from IP addresses found in the known threat lists:

• http://www.dshield.org/feeds/suspiciousdomains_High.txt
• http://feeds.dshield.org/block.txt

Threat Feeds – details

Botnet Command & Control (Emergingthreats.net)

This widget shows traffic to and from IP addresses found in the known threat list:

• http://rules.emergingthreats.net/blockrules/emerging-botcc.rules

Malicious Hosts (Alienvault Reputation)

This widget shows traffic to and from IP addresses found in the known threat list:

• http://reputation.alienvault.com/reputation.snort

Malicious Hosts (Alienvault Reputation) – details