Ignore events when the username is "password"?

  • Thread starter Thread starter dustin
  • Start date Start date
D

dustin

Hi -

I am using an event log monitoring tool (GFI Security Event Log
Monitor 5) that lets me set up events to watch for. It also comes
with some pre-configured "recommended" items to watch for. I noticed
a rule that says "Ignore 529 event when user name equals password". I
noticed 4 other identical rules (ignore when someone enters "password"
as their username) for events 528, 680, 676, and 681 also. Anyone
know why I would want to ignore these?
 
The reason we do it is because GFI's Network Security Scanner tries logins
with a username of "password" that fills up our event logs when we scan for
missing patches and other vulnerabilites ... Kind of stupid, huh ??? They
add a "feature" to one product because of a weakness in another of their
products :-) ...
 
Back
Top