FA Bulletin Boards

FA algorithms are posted to one of three Bulletin boards, depending on their importance and likelihood that a host has been compromised. The different bulletin boards are:

  • Policy Events
  • Indicators of Compromise (IOC)
  • Security Events

Policy Events

Algorithms that post to this bulletin board are those that detect network traffic that generally have no direct security implications, but may violate the network policy. The following algorithms are posted to the Policy Events BB by default:

  • Excessive Jitter
  • Multicast Violations
  • IP Address Violation
  • P2P Detection

Indicators of Compromise (IOC)

The algorithms that post to the IOC bulletin board (BB) are those that indicate possible malware activity with insufficient confidence to initiate a security event alarm. This is a bulletin board that should be periodically reviewed to pick up on recent changes. If multiple IOCs are associated with a single host, these may generate an “Indicator Correlation Event” alarm that is posted to the Security Event BB. This is discussed in more detail below. The following algorithms are posted to the IOC Events BB by default:

  • Breach Attempt Detection
  • DNS Hits
  • ICMP Port Unreachable
  • ICMP Destination Unreachable
  • Denied Flows
  • Domain Reputation
  • FIN Scan
  • NULL Scan
  • Odd TCP Flags Scan
  • Persistent Flow Risk
  • RST/ACK Scan
  • SYN Scan
  • TCP Scan
  • UDP Scan
  • XMAS Scan

Security Events

The algorithms that post to the Security Events bulletin board are high confidence detections that a host is compromised. Any events posted to this bulletin board should be investigated. The following algorithms are posted to the Security Events BB by default:

  • BotNet Detection
  • DDoS Detection
  • DRDoS Detection
  • DNS Command and Control Detection
  • DNS Data Leak
  • Indicator Correlation Event
  • Malware Behavior Detection
  • Malware Domain Communications
  • Host Reputation (Tor, Blackhole, Malware C&C Server, and user defined)


Edit the policy for any algorithm to change the Bulletin Board from the default settings.