Index of BSM Audit Sessions in this Dataset

This page provide a quick-and-dirty interface to scan the audit sessions that exist in this particular BSM logfile.
The table lists every audit session found in the BSM file. For each session audit records are segmented out in text (praudit -l) format. In the future, it might certainly be desireable to generate these same lists of packets, but in binary format. At this point in time we are still working on a good way to do that.

• The first column lists the session id number, as retrived from the BSM "subject" token.
• The second column indicates if this session is blatantly part of the attack. This was done by looking for the attacking host name in the praudit output using grep, so its pretty rough and only a very first step toward labeling each and every record as "attack" or "normal".
• The third column gives praudit (-l) output of all bsm records in that session
• The forth column gives a list of those records found in the zero session but which were generated by the process that formed the basis of that audit session. (This mainly seems to be necessary for Solaris 2.7 auditing, where records from one process, the one that starts an auditing session, seem to get split between the 0 session and the session log itself.)