10 12, 2010

Detecting a distributed reflected DNS attack

By | 2010-12-10T15:52:57+00:00 December 10th, 2010|Cyber Crime, Firewall Analysis, How To, Log File Analysis, System Administration, Uncategorized, Vantage|0 Comments

The other night as I was getting ready to sleep, I received an email from the host of my personal Linux VPS saying that I had exceeded my monthly transfer quota. I didn't pay much mind to the warning, as the excess transfer was insignificant, and at that time I was too tired to care. I closed my email, got into bed and fell asleep.

11 06, 2010

Accessing Microsoft Forefront TMG's Log Files (SQL Express)

By | 2010-06-11T06:54:59+00:00 June 11th, 2010|Firewall Analysis, How To, Loaders, Log File Analysis, Microsoft Threat Management Gateway, Uncategorized, Vantage, Web Browsing Analysis, WebSpy|1 Comment

If you need to analyze and report on Microsoft Forefront Threat Management Gateway log files, the most common stumbling block is enabling access to the default SQL Express databases that contains the firewall and web proxy log files. The log databases are stored in an SQL Express instance named MSFW. By default these databases cannot [...]