Triggers are used to search for data in the QoE Stor by specified parameters. After the trigger action one of the following steps is possible:

• notification in GUI
• HTTP action
• sending an email

The required options of the Stingray Service Gateway:

• Statistics gathering and analysis on protocols and directions
• Subscriber notifications

Required additional modules:

• DPIUI2 (GUI - Graphical User Interface)
• QoE Stor (Statistics collection module)

Trigger to detect SSH bruteforce attacks (Name - "ssh bruteforce") is a system trigger and is available in the subsection "QoE Analytics" - "Triggers and Notifications" (disabled by default).

• The name of the trigger "ssh bruteforce";
• Days of the week - all;
• Checking frequency - every 10 minutes;
• Trigger frequency - 0;
• Start/end dates and times are customizable if needed.

For this trigger, an uneditable query with the following parameters is set:

• Table to scan: Raw full netflow → Tables → Attacks detection → SSH bruteforce;
• Period from: now - 30 minutes
• Period from: now - 20 minutes

• Add "+" 2 fields
• Bind - AND
• Function - avg
• Series in field 1 - session lifetime to subscriber <= 20(ms)
• Series in field 2 - number of sessions per subscriber >= 1500

• In the "If no error" field - no data
• In the "If execution error or timeout" field - save the last state

• For automatic filling of the form - click on the "</>" icon
• In the "Send to" field - specify an email address
• With this setting, when triggered, a notification will be sent to the specified email address: ID, trigger name, status, link to the report (saved state).

• For automatic filling of the form - click on the "</>" icon
• Select the type of notification - "Warning"
• This setting will create a notification in the Stingray Service Gateway

You can get a link to the report in the notification menu

Choose the notification Click "Details"

Click on the link to the report - the report will open in a new browser tab.

• For automatic filling of the form - click on the "</>" icon
• Choose the most suitable method for your ticket system and enter the URL.