Monitor any potential attacks

Question

Hi,
How to monitor any potential attacks towards one specific IP reachable from outside? How to defend server against such attacks?

Answer 1

Hi @Peter_1985 ,

If you want to prevent malware from infecting your windows server 2016, windows Defender AV is malware protection that immediately and actively protects Windows Server 2016 against known malware and can regularly update antimalware definitions through Windows Update.

For your reference:

Windows Defender Antivirus for Windows Server

Best Regards,

Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi Jackson,

there is no monitoring switch "potential attack".
Every Server has a purpose (Web-, File-, SQL-, etc...).
You have to know the standard how a server is to be accessed and monitor for everything unusual.
Unintended behavior could be:

• port scans
• excessive login tries with well-known user-names (admin, root, sa)
• strange http- or sql-queries
• rudy attacks
• and many, many more
  All this is still basic monitoring. imho your question is too unspecific to give a better answer.

Best regards

GF

Answer 3

Hi ,

As far as I know, there is no build-in tool can monitor any potential attacks. You may use some third-party software to monitor attacks. Then use windows firewall to prevent external attack. Windows Defender Firewall with Advanced Security provides host-based, two-way network traffic filtering and blocks unauthorized network traffic flowing into or out of the local device. It acts as a filter to block non-legitimate incoming traffic before it could enter your organization’s network to cause damage.

For your reference:

Best practices for configuring Windows Defender Firewall

Best Regards,

Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

Hi,
Is it to choose "Remote assistant" below?

How to make "Remote assistant" rule below?

netsh advfirewall firewall add rule name="Rule L1" dir=in action=block remoteip=193.169.1.1-193.169.255.255

Within Windows server, can we know which IP ever was attacking the server? Is there any log showing this?

Answer 5

Hi @Peter_1985 ,

Within Windows server, can we know which IP ever was attacking the server? Is there any log showing this?

There are no built-in tools or logs can monitor which IP is attacking. We can only use network monitor to capture all the traffic that is flowing to and from the selected network adapters on the local computer.

If you want to monitor your network closely at all time and identifies anomalies in network traffic, third-party software may achieve your goal.

Is it to choose "Remote assistant" below?

Why did you mention Remote assistant? If you want to block a suspicious IP address or IP range, just use Windows Firewall to block this connection. Just like the command you post above:

netsh advfirewall firewall add rule name="Rule L1" dir=in action=block remoteip=193.169.1.1-193.169.255.255  

Best Regards,

Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.