<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Batang;
panose-1:2 3 6 0 0 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"\@Batang";
panose-1:2 3 6 0 0 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
text-align:justify;
mso-line-height-alt:10.0pt;
layout-grid-mode:char;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.tablecolumnheader, li.tablecolumnheader, div.tablecolumnheader
{mso-style-name:tablecolumnheader;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
text-align:justify;
mso-line-height-alt:10.0pt;
layout-grid-mode:char;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
p.tablecells, li.tablecells, div.tablecells
{mso-style-name:tablecells;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
text-align:justify;
mso-line-height-alt:10.0pt;
layout-grid-mode:char;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
mso-fareast-language:EN-US;}
span.EmailStyle27
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="en-IL" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal" align="left" style="text-align:left"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US">Dear DDoS C&A subscribers,<br>
<br>
As part of the current maintenance window we have made the following changes to NeMo:<br>
<br>
1. Following an organisational wide mail system upgrade, the sender address for alerts has been changed to:
<a href="mailto:nemo-ddos@host.geant.org">nemo-ddos@<b>host</b>.geant.org</a> with the added implementation of DKIM-signed emails. This may affect rules/filters you have configured for NeMo emails. Please update as needed.<br>
<br>
2. We have increased all detection thresholds by 10x in order to reduce false positives for what we have observed over the past couple of months as "ignorable" alerts (likely to have no-to-negligible impact and also not requiring mitigation in the GÉANT network).
The thresholds have been adjusted as follows:</span><span lang="EN-US" style="font-size:12.0pt;mso-fareast-language:#2000"><o:p></o:p></span></p>
<div align="center">
<table class="MsoNormalTable" border="1" cellspacing="0" cellpadding="0" width="491" style="width:368.3pt;border-collapse:collapse;border:none">
<tbody>
<tr>
<td width="132" valign="top" style="width:99.0pt;border:solid #ADADAD 1.0pt;background:#1A75A0;padding:0cm 5.4pt 0cm 5.4pt">
<p class="tablecolumnheader"><span lang="EN-GB" style="font-family:"Aptos",sans-serif;color:white;mso-fareast-language:EN-GB">Sensitivity Category</span><span lang="EN-US"><o:p></o:p></span></p>
</td>
<td width="217" valign="top" style="width:163.0pt;border:solid #ADADAD 1.0pt;border-left:none;background:#1A75A0;padding:0cm 5.4pt 0cm 5.4pt">
<p class="tablecolumnheader"><span lang="EN-GB" style="font-family:"Aptos",sans-serif;color:white;mso-fareast-language:EN-GB">Detector ‘ignore below’ parameter value (packets per minute)*</span><span lang="EN-US"><o:p></o:p></span></p>
</td>
<td width="142" valign="top" style="width:106.3pt;border:solid #ADADAD 1.0pt;border-left:none;background:#1A75A0;padding:0cm 5.4pt 0cm 5.4pt">
<p class="tablecolumnheader"><span lang="EN-GB" style="font-family:"Aptos",sans-serif;color:white;mso-fareast-language:EN-GB">Equivalent packets per second value</span><span lang="EN-US"><o:p></o:p></span></p>
</td>
</tr>
<tr>
<td width="132" valign="top" style="width:99.0pt;border:solid #ADADAD 1.0pt;border-top:none;padding:0cm 5.4pt 0cm 5.4pt">
<p class="tablecells"><span lang="EN-GB">Default</span><span lang="EN-US"><o:p></o:p></span></p>
</td>
<td width="217" valign="top" style="width:163.0pt;border-top:none;border-left:none;border-bottom:solid #ADADAD 1.0pt;border-right:solid #ADADAD 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
<p class="tablecells"><span lang="EN-GB">300000<b>0</b> ppm</span><span lang="EN-US"><o:p></o:p></span></p>
</td>
<td width="142" valign="top" style="width:106.3pt;border-top:none;border-left:none;border-bottom:solid #ADADAD 1.0pt;border-right:solid #ADADAD 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
<p class="tablecells"><span lang="EN-GB">5000<b>0</b> pps </span><span lang="EN-US"><o:p></o:p></span></p>
</td>
</tr>
<tr>
<td width="132" valign="top" style="width:99.0pt;border:solid #ADADAD 1.0pt;border-top:none;padding:0cm 5.4pt 0cm 5.4pt">
<p class="tablecells"><span lang="EN-GB">Low</span><span lang="EN-US"><o:p></o:p></span></p>
</td>
<td width="217" valign="top" style="width:163.0pt;border-top:none;border-left:none;border-bottom:solid #ADADAD 1.0pt;border-right:solid #ADADAD 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
<p class="tablecells"><span lang="EN-GB">600000<b>0</b> ppm</span><span lang="EN-US"><o:p></o:p></span></p>
</td>
<td width="142" valign="top" style="width:106.3pt;border-top:none;border-left:none;border-bottom:solid #ADADAD 1.0pt;border-right:solid #ADADAD 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
<p class="tablecells"><span lang="EN-GB">10000<b>0</b> pps </span><span lang="EN-US"><o:p></o:p></span></p>
</td>
</tr>
<tr>
<td width="132" valign="top" style="width:99.0pt;border:solid #ADADAD 1.0pt;border-top:none;padding:0cm 5.4pt 0cm 5.4pt">
<p class="tablecells"><span lang="EN-GB">High</span><span lang="EN-US"><o:p></o:p></span></p>
</td>
<td width="217" valign="top" style="width:163.0pt;border-top:none;border-left:none;border-bottom:solid #ADADAD 1.0pt;border-right:solid #ADADAD 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
<p class="tablecells"><span lang="EN-GB">60000<b>0</b> ppm</span><span lang="EN-US"><o:p></o:p></span></p>
</td>
<td width="142" valign="top" style="width:106.3pt;border-top:none;border-left:none;border-bottom:solid #ADADAD 1.0pt;border-right:solid #ADADAD 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
<p class="tablecells"><span lang="EN-GB">1000<b>0</b> pps </span><span lang="EN-US"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</div>
<p class="MsoNormal" align="left" style="text-align:left;line-height:normal;layout-grid-mode:both">
<span style="font-size:12.0pt;font-family:"Aptos",sans-serif;mso-fareast-language:#2000"><br>
Meaning that we do not expect to see alerts for events below those values (unless multiple events are combined into a meta-alert). Initial testing indicates that on average the amount of alerts should be reduced to about 1/3 of what they currently are/were.
Further optimisation is ongoing (e.g. we will likely add bandwidth thresholds as well) with the aim of only raising alerts for events likely to have impact and worthy of attention.
<br>
<br>
Please note that if you've previously requested <b>customised thresholds</b> for any of your objects that these
<b>have not been changed</b>. <o:p></o:p></span></p>
<p class="MsoNormal" align="left" style="text-align:left;line-height:normal;layout-grid-mode:both">
<span style="font-size:12.0pt;font-family:"Aptos",sans-serif;mso-fareast-language:#2000"><br>
Thank you for your cooperation and ongoing interest. Any queries please reply to this email.<br>
<br>
Best regards,<br>
<br>
Roderick Mooi (and also on behalf of our SOC)<br>
<br>
<o:p></o:p></span></p>
<pre>-- <o:p></o:p></pre>
<pre>Senior (Information) Security Officer<o:p></o:p></pre>
<pre>DDoS C&A Service Owner<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>GÉANT<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>PGP: 969E B264 D516 3BF3 7AA6 1F7D 7744 5FF8 9A07 86D6<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Network • Services • Community<o:p></o:p></pre>
</div>
</body>
</html>