inet_alert

Description Notify a company's Internet Service Provider (ISP) when the company's corporate network is under attack. The inet_alert utility forwards log messages generated by the alert daemon to an external Management Station, typically located at the ISP site. The ISP can then analyze the alert and decide how to react.

inet_alert uses the ELA Protocol to send the alert. The Management Station receiving the alert must be running the ELA Proxy.

If communication with the ELA Proxy is to be authenticated or encrypted, a key exchange must be performed between the Management Station running the ELA Proxy and the Security Gateway generating the alert.

To use this utility, enter it into a script. From Global Properties > Logs and alert > alert commands > early versions compatibility > run 4.x alert script, and enter the name of the script.

Syntax

# inet_alert -s <ipaddr> [-o] [-a <auth_type>] [-p <port>] [-f <token value>] [-m <alerttype>]

Parameter	Description
`-s <ipaddr>`	The IP address (in dot format) of the ELA Proxy to be contacted.
`-o`	Print the alert log received by `inet_alert` to `stdout`. Use this option when `inet_alert` is part of a pipe.
`-a <auth_type>`	The type of connection to the ELA Proxy. One of the following values: ssl_opsec`. Means the connection is authenticated and encrypted, (Default)` auth_opsec`. Means the connection is authenticated.` clear`. Means the connection is neither authenticated nor encrypted.`
`-p <port>`	The ELA proxy's port number. Default is `18187`.
`-f <token value>`	A field to be added to the log, represented by a `token-value` pair as follows: `token` is the name of the field to be added to the log. `token` may not contain spaces. `value` is the field's value. `value` may not contain spaces. This option may be used multiple times to add multiple `token-value` pairs to the log. If `token` is a reserved log field name, the specified field's value will appear in the corresponding column in SmartView Tracker. Otherwise, the `token-value` pair will be displayed in the Info. column in SmartView Tracker.
`-m <alerttype>`	The alert to be triggered at the ISP site. This alert overrides the alert specified in the log message generated by the alert daemon. The response to the alert is handled according to the actions specified in the ISP's Security Policy: The following alerts execute the OS commands defined in the corresponding fields of the Log and Alert tab of the Properties Setup window in Global Properties: alert`. Popup alert command.` mail`. Mail alert command.` snmptrap`. SNMP trap alert command.` spoofalert`. Anti-spoof alert command.` The following NetQuota and ServerQuota alerts execute the OS commands specified in: `$FWDIR/conf/objects.C:` `value=clientquotaalert. Parameter=clientquotaalertcmd`

Return Value

Exit status	Description
`0`	Execution was successful.
`102`	Undetermined error.
`103`	Unable to allocate memory.
`104`	Unable to obtain log information from `stdin`.
`106`	Invalid command line arguments.
`107`	Failed to invoke the OPSEC API.

Example

# inet_alert -s 10.0.2.4 -a clear -f product cads -m alert

This command specifies that in the event of an attack, inet_alert should take the following actions:

Establish a clear connection with the ELA Proxy located at IP address 10.0.2.4.
Send a log message to the specified ELA Proxy. The product field of this log message should be set to "cads". This means that "cads" will be displayed in the product column of SmartView Tracker.
Trigger the OS command specified in the Popup Alert Command field of the Log and Alert tab of the Properties Setup window in the SmartDashboard.