Threat Level: green Handler on Duty: Scott Fendley

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Contacting the ISC, good practices for response

Published: 2006-08-31
Last Updated: 2006-08-31 12:15:03 UTC
by Joel Esler (Version: 1)
0 comment(s)
Recently we've received several good emails, concerning many of the topics that we've discussed recently on our Diary entries.  Port 139 traffic, HP JetDirect traffic, Java updates, you name it, we've received email about it.

The problem with a couple of these excellent emails is...  the sender hasn't left their email address!  We had one individual write us and offer packet captures of the 139/445 traffic that has been reported, but didn't leave their email address for us to contact him. 

So please, these items are essential.  If you are thinking about not submitting your email address for privacy reasons, feel free to do so, we try to make a habit about not posting people's email addresses on the site.  We like to give credit where credit is due, but if you do not want your name mentioned at all, make sure and check the radio button that says "Do NOT mention my name".

You may contact the ISC by clicking on the Handler of the Day's name at the top of the page, or clicking on "Contact" at the bottom right of the page.

Thank you for your submissions about this "NT4/2000 worm" that is rumored to be spreading around, we'd love to receive full packet captures of the traffic, as well as any binaries that it drops.  (If there really is a worm).

Thanks!
Keywords: faq
0 comment(s)
Diary Archives