Intrusions and Alerts

ISA Server features an intrusion-detection mechanism, identifying when an attack is attempted against your network, and performing a set of configured actions in case of an attack.

To detect unwanted intruders, ISA Server compares network traffic and log entries to well-known attack methods. Suspicious activities trigger alerts, which are a set of configurable actions. Actions include connection termination, service termination, e-mail alerts, and logging.

ISA Server monitors for the following types of attacks:

• All-port scan attack
• Enumerated-port scan attack
• IP-half scan attack
• Land attack
• Ping-of-death attack
• UDP bomb attack
• Windows out-of-band attack

For more information, see the ISA Server product documentation.