IISIDSD

IisIdsD can now be installed and run as a service (need to find out if it can survive a reboot yet) It now begins monitoring the live ETW feed, and the ban has been extended from 5 minutes to 24 hours - I was seeing several probes from the same IP address that had been banned several times overnight, s I think the initial 5 minute ban wasn't sufficient enough to slow the probes enough Am adding a SQLite back-end to store the records in, as I'm only wanting the past 24 hours worth of live data to be shown in the live etw display Will also be adding an API that will permit the iisidsd.com website to export a list of problematic IP addresses from the database and publish those IP addresses as a rogue's gallery of problematic IP addresses for others to consume (need to provide the infrmation in tabular form on an page, and provide fr a json-formatted list Will be publishing a demo shortly as well - the demo will be able to scan through the IIS logs and report on the suspicious activity detected within them - it will not be able to run as a service, monitor the live etw feed from the IIS server, interact with the IP DENY lists for the targetted domains, nor will it has the SQLite db back-end - it's gonna be a demo ffs :P :D Watch this space -=A=- .