Recently Viewed Topics
When PVS detects a real-time event, it can:
- Send the event to a local log file.
- Send the event via Syslog to a log aggregator such as Tenable’s LCE, an internal log aggregation server.
- Send the event to a third party security event management vendor.
New Host Alerting
You can configure PVS to detect when a new host has been added to the network. By default, PVS has no knowledge of your network’s active hosts, so the first packets PVS sniffs trigger an alert. To avoid this, you can configure PVS to learn the network over a period of days. Once this period is over, any “new” traffic must be from a host that has not communicated during the initial training.
When PVS logs a new host, the Ethernet address saves in the message. When PVS is more than one hop away from the sniffed traffic, the Ethernet address is that of the local switch and not the actual host. If the scanner is deployed in the same collision domain as the sniffed server, then the Ethernet address is accurate.
For DHCP networks, PVS often detects a “new” host. Tenable recommends deploying this feature on non-volatile networks such as DMZ. Users should also consider analyzing PVS “new” host alerts with SecurityCenter CV, which can sort real-time PVS events by networks.