HLBRW is an acronym for Hogwash Light BR Watch. It is a tool to help make rules for HLBR. In other words, HLBRW was made to be used by HLBR users needing make new rules. It requires some expertise with HLBR, the TCP/IP protocol suite, and regular expressions. HLBRW is a script started by iwatch (a system events watch program) when the HLBR event log is modified. The concept is very single: if the HLBR log was modified, then a known attack was blocked. But the attacker might take other subsequent actions unknown by HLBR. When HLBRW starts, it will coordinate a tcpdump session to record the traffic generated by the attacker's IP address for the next few minutes. If the recorded traffic isn't relevant (without a push in TCP or another relevant protocol), the created file will be deleted. Based on the recorded traffic, the network security manager can make new rules. HLBRW is part of the HLBR project, an intrusion prevention system (IPS) used in firewall systems.
|Tags||HLBR Firewall IPS Security Network|
|Implementation||bash shell scripting|
Release Notes: When directories are created, this is registered in the log. Directory permissions are changed to 0755 after creation. The destination directory after moves is registered in the log.
Release Notes: This release fixes the syntax in the iwatch.xml.sample, improves the main code, and removes the iwatch-restart.sh file (it was added to main code).