16234,9013546_DragonHost_DS 3/29/04 12:06 PM Page 1 Dragon™ Host Sensor • Host-based intrusion defense via a modular, flexible architecture for today’s most common operating system • Protects at the host and application level by monitoring the operating system and crucial applications • Application Intrusion Prevention module averts attacks on the most commonly targeted applications—DNS servers, mail servers, web servers • Application Intrusion Scalable, Flexible Host-Based Dragon Host Sensor deploys advanced Prevention Intrusion Defense techniques in identifying root-kits and buffer — Averts attacks on the overflows via its kernel-monitoring module. A host-based intrusion defense tool, Dragon most widely used web This module traps and analyzes all calls Host Sensor prevents web attacks and applications, IIS and into the kernel and can identify the monitors individual systems running today’s Apache existence of any kernel-level root-kit, most common operating systems, for evidence • File attribute monitoring an absolute requirement in identifying of malicious or suspicious activity in real time. — Monitors file attributes compromised systems before an attacker such as owner, group, Dragon Host Sensor may be deployed on a completely covers their tracks. It can also permissions, file size protected host where it uses a variety of identify anomalous privilege escalations • File integrity checking techniques to detect attacks and misuse on states resulting from successful buffer — Monitors files or dire c t o r i e s the system, including analyzing the security overflows. Dragon’s kernel monitoring to determine if content event log, checking the integrity of critical capabilities are an essential building block has been changed via configuration files, or checking for kernel- on the path to host-based intrusion preven- MD5 hash level compromises. This hybrid approach tion—failure to implement this step leaves • Log file analysis ensures that no misuse goes undetected. the host open to attacks that other intrusion — Analyzes any file or prevention solutions cannot detect. directory against a Dragon Host Sensor may also be deployed signature policy on a dedicated analysis system where logs Centrally managed via Dragon Enterprise • Windows event log analysis are forwared and analyzed from most M a n a g e m e n t Server for signature and — Monitors Windows event commercial firewalls, routers, switches and configuration updates, Dragon Host Sensor logs for sign of misuse or other IDS devices. Correlating events from also reports all information—including attack these devices and from Dragon Network event description, source/destination IP, • Windows registry analysis and Host Sensors is critical in identifying source/destination port, raw log (if applicable) — Analyzes the Windows which events are the most serious, as well and timestamp—to the Security Information registry for attributes that as understanding their origin and impact. Management functionality within Dragon should not be accessed Management Server for real-time alerting, and/or modified The new Dragon Host Sensor A p p l i c a t i o n forensic and trend analysis. • TCP/UDP service detection Intrusion Prevention module averts attacks on the most commonly targeted — Monitors for opened TCP and UDP ports, providing applications—such as DNS servers, mail critical protection against servers, and web servers running Microsoft backdoor services IIS and Apache. • Kernel monitoring Using non-conventional techniques to — Detects suspicious identify attempted intrusions or general privilege escalations and other signs of kernel-level misuse, the Host Sensor can be installed compromise on a dedicated system to create a “deceptive” • Custom module interface server designed to entice an alarm on attempted intrusions by simulating a fake — Provides an open and easy interface for custom web server, telnet server, or mail server. module development Page 1 of 2 • Data Sheet 16234,9013546_DragonHost_DS 3/29/04 12:06 PM Page 2 Specifications Technical Specifications Operating Systems Dragon Host Sensor: Windows NT/2K/XP, Sparc Solaris (versions 8 and 9), AIX (versions 4.3.3 and 5.X), HPUX (version 11.x), and Linux Distributions: Red Hat (versions 8.0 and 9.0), SuSE (version 8.1), Mandrake (version 9), Slackware (version 8.1) and Debian Ordering Information Host Sensor Software DSHSS-WIN Dragon Host Sensor software for Windows DSHSS-LNX Dragon Host Sensor software for Linux DSHSS-SOL Dragon Host Sensor software for Solaris DSHSS-HPX Dragon Host Sensor software for HP-UX DSHSS-AIX Dragon Host Sensor software for AIX Warranty Additional Information As a customer-centric company, Enterasys is committed to For more information about Enterasys Dragon, visit the providing the best possible workmanship and design in web at http://www.enterasys.com/products/ids our product set. The Dragon product family includes a Contact Information ninety (90) day warranty for software that covers defects in media only, and a one (1) year warranty for hardware. Contact Enterasys Sales at 877-801-7082 or Service and Support enterasys.com/ Enterasys Networks Enterasys understands that superior service and support is a Corporate Headquarters ™ critical component of Networks that Know. The Enterasys 50 Minuteman Road SupportNet Portfolio—a suite of innovative and flexible Andover, MA 01810 service and support offerings—completes the Enterasys solu- U.S.A tion. SupportNet offers all the post-implementation support services you need—online, onsite or over the phone—to maintain your network availability and performance. Dragon is a re g i s t e red trademark of Enterasys Networks. All other products or services mentioned are identified by the trademarks or service marks of their respective companies or organizations. NOTE: Enterasys Networks reserves the right to change specifications without notice. Please contact your representative to confirm current specifications. All contents are copyright © 2004 Enterasys Networks, Inc. All rights re s e r v e d . Lit. #9013546 3/04 Page 2 of 2 • Data Sheet