作者: Marcus Ranum , Renaud Deraison , Ron Gula
DOI:
关键词:
摘要: The system and method described herein relates to a log correlation engine that may cross-reference or otherwise leverage existing vulnerability data in an extensible manner support network asset discovery. In particular, the receive various logs contain events describing observed activity discover response containing at least one event matches regular expression rule associated with indicates vulnerability. then obtain information about indicated from source cross-referenced generate report was discovered network, wherein include obtained rule.