Data reporting

As supporting documentation for this IP data, BMC Defender Server generates a comprehensive report that can be used to determine the status of each IP address entry. This report is generated for each new reputation database update, and is downloadable from the BMC Defender Server. 


Related topic

BMC-Defender-Server-block-list-and-reputation-database

This report contains the following metrics:

  • Subnet address—This is the address subnet entry in the reputation database. There are typically 10-30 thousand entries in the list. These items are added to the @@ip_blocklist@@ list macro (either manually or by the Auto-Feed adapter described in Auto-Update-feed-adapter).
  • Country code and name—This is the two-letter country code and full country name for the subnet entry in the database. This is the same information as found in the Geo-IP database.
  • Registration date—This is the date and time of the registration for the IP address hostname.
  • Reference hostname—This is the host name entry corresponding to the first device on the subnet (if known). The value might be unknown.
  • Reference list identifier and reference count—This is the name of the block list (corresponding to the List Identifiers in the previous section) that indicates where this entry can be found. If the IP address matches multiple lists, only the first list identifier is provided. This field also lists the number of lists that match the specified subnet name. This value can also be displayed by entering the IP address of a device in the standard DNS Tool. See additional note.
  • Persistence—This flag is set to either Yes or No, and indicates that the particular device has previously been found on the system (Yes) or is a new device (No). This can be used to determine how indiscriminate this subnet is.

The report information and corresponding block lists are available using separate URLs, typically downloaded automatically using the Auto-Update-feed-adapter. Users can access the report information either from the Adapter plug-in screen, or using the DNS Tool screen (available using the More menu in the upper right of all screens).

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*