Please see the Features Page for more details.

KFSensor Administration Console

Ports View

Displays the simulated services on each port. Ports are color coded to indicate recent activity.
The events displayed are from a variety of real life attack.

Visitor View

Displays each visitor to the sensor.

Remote Sensors

Enables the viewing of multiple remote sensors and their events on one console.

System Tray

When not in use the Administration Console sits in the system tray.
It flashes red and plays an alarm sound (optional) when an attack is detected.

Reports

Reports menu

A range of different reports are available.

Events by day Report

Chronological reports are available to analyse how attacks change over time.

Top Visitors Report

List the biggest threats by different criteria.

Report Filter

Customize a report by filtering the data on the time period, port and location of the visitors.

Event investigation

Event Details

Each event contains a wealth of detail, thus enabling further analysis of an attack.

Opaserv worm

View a detailed log of the data transmitted during an attack.
This example shows the Opaserv worm attempting spread itself via SMB.

RPC Blaster worm

View the data in different formats.
This example shows the Blaster worm's payload in Hex.

Edit Scenario

Each sensor can be configured for specific tasks or to simulate different systems and services.

Signatures

Identify attacks

Known attack patterns are identified by the signature IDS engine, with the signature details available in the events view.

Edit Signature Base

Signature rule administration is totally GUI based.

Edit Signature Rule

Signature rules support both port-based filters and multiple signatures.
Signatures support string, URL and decoded data searches as well as regular expressions.

Import Signatures

Import Snort format rule sets directly into KFSensor.

Configurable

Control Remote Sensors

KFSensor can manage multiple sensor installations across the network, from a single console. All are protected by 3072-bit RSA public/private key authentication and 256-bit AES encryption.

Edit Ports

KFSensor can be configured to listen on any port.

Edit Scenario

Each sensor can be configured for specific tasks or to simulate different systems and services.

NBT Settings

Users can decide exactly how KFSensor should respond to a NetBIOS scan, and configure the system accordingly.

HTTP Emulation

Each server emulation can be configured.

Add/Remove Columns

The interface is fully customizable, allowing users to choose exactly how event details are displayed.

Custom Enhancements

External Database Log

Write your own custom reports in Access, or any other SQL database.

External Emulation

Write your own custom server emulations, using languages like PERL.

Spammer Log

Load the log of spam attacks into a database for further analysis.