<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE FirewallAction [
<!ELEMENT FirewallAction	(act+)>
<!ELEMENT act		(id,applicable,title,sourceIP,destIP,protocol,port,scoreif,vHappy,vSad,aHappy,aSad)>
<!ELEMENT id			(#PCDATA)>
<!ELEMENT applicable	(#PCDATA)>
<!ELEMENT title		(#PCDATA)>
<!ELEMENT sourceIP		(#PCDATA)>
<!ELEMENT destIP		(#PCDATA)>
<!ELEMENT protocol		(#PCDATA)>
<!ELEMENT port		(#PCDATA)>
<!ELEMENT scoreif		(#PCDATA)>
<!ELEMENT vHappy		(#PCDATA)>
<!ELEMENT vSad		(#PCDATA)>
<!ELEMENT aHappy		(#PCDATA)>
<!ELEMENT aSad		(#PCDATA)>
]>
<FirewallAction>
<act><id>web</id><applicable>true</applicable><title>View the home page of their website</title><sourceIP>1.2.3.4</sourceIP><destIP>152.8.1.1</destIP><protocol>tcp</protocol><port>443</port><scoreif>deny</scoreif><vHappy>#a successfully and safely accessed your web server.</vHappy><vSad>#a was prevented from accessing your web server using HTTPS. -1 point</vSad><aHappy>You were denied access to #v's web server. +1 point</aHappy><aSad>You successfully accessed #v's web server. No change in score.</aSad></act>
<act><id>DNS</id><applicable>true</applicable><title>Retrieve an IP address from their Domain Name Server</title><sourceIP>1.2.3.4</sourceIP><destIP>152.8.3.3</destIP><protocol>udp</protocol><port>53</port><scoreif>deny</scoreif><vHappy>#a successfully and safely accessed your Domain Name Server.</vHappy><vSad>#a was prevented from accessing your Domain Name Server. -1 point</vSad><aHappy>You were denied access to #v's Domain Name Server. +1 point</aHappy><aSad>You successfully accessed #v's Domain Name Server. No change in score.</aSad></act>
<act><id>email</id><applicable>true</applicable><title>Send regular email.</title><sourceIP>1.2.3.4</sourceIP><destIP>152.8.2.2</destIP><protocol>tcp</protocol><port>25</port><scoreif>deny</scoreif><vHappy>#a successfully and safely send you email.</vHappy><vSad>#a was prevented from sending you safe email. -1 point</vSad><aHappy>You were prevented from sending email to #v. +1 point</aHappy><aSad>You successfully sent email to #v. No change in score.</aSad></act>
<act><id>corwith</id><applicable>true</applicable><title>Corwith attack on user web servers</title><sourceIP>1.2.3.4</sourceIP><destIP>152.8.100.1</destIP><protocol>tcp</protocol><port>80</port><scoreif>permit</scoreif><vHappy>#a was prevented from attacking Fred's web server.</vHappy><vSad>#a attacked a web server on Fred's computer with the Corwith intrusion. -1 point</vSad><aHappy>You successfully attacked one of #v's user PCs with the Corwith intrusion. +1 point</aHappy><aSad>You were prevented from attacking a user computer of #v. No change in score.</aSad></act>
<act><id>pop</id><applicable>false</applicable><title>Access email via POP from the Internet.</title><sourceIP>1.2.3.4</sourceIP><destIP>152.8.2.2</destIP><protocol>tcp</protocol><port>110</port><scoreif>deny</scoreif><vHappy>#a successfully and safely read email via POP3.</vHappy><vSad>#a was prevented from reading email over the Internet via POP. -1 point</vSad><aHappy>You were prevented from reading #v email via POP. +1 point</aHappy><aSad>You successfully read #v email via POP. No change in score.</aSad></act>
<act><id>imap</id><applicable>false</applicable><title>Access email via IMAP4 from the Internet.</title><sourceIP>1.2.3.4</sourceIP><destIP>152.8.2.2</destIP><protocol>tcp</protocol><port>143</port><scoreif>deny</scoreif><vHappy>#a successfully and safely read email via IMAP.</vHappy><vSad>#a was prevented from reading email over the Internet via IMAP. -1 point</vSad><aHappy>You were prevented from reading #v email via IMAP. +1 point</aHappy><aSad>You successfully read #v email via IMAP. No change in score.</aSad></act>
<act><id>FTP</id><applicable>false</applicable><title>Copy a file from their FTP server</title><sourceIP>1.2.3.4</sourceIP><destIP>152.8.4.4</destIP><protocol>tcp</protocol><port>21</port><scoreif>deny</scoreif><vHappy>#a successfully and safely accessed your FTP server.</vHappy><vSad>#a was prevented from accessing your FTP server. -1 point</vSad><aHappy>You were denied access to #v's FTP server. +1 point</aHappy><aSad>You successfully accessed #v's FTP server. No change in score.</aSad></act>
<act><id>snmp</id><applicable>true</applicable><title>Access SNMP data on their system.</title><sourceIP>1.2.3.4</sourceIP><destIP>152.8.5.5</destIP><protocol>tcp</protocol><port>161</port><scoreif>permit</scoreif><vHappy>#a was prevented from accessing your SNMP data.</vHappy><vSad>#a retrieved SNMP data from your systems. -1 point</vSad><aHappy>You successfully read SNMP data from #v's system. +1 point</aHappy><aSad>You were prevented from reading SNMP data from #v's system. No change in score.</aSad></act>
<act><id>time</id><applicable>false</applicable><title>Employees want to set their clock from a network time server.</title><sourceIP>1.2.3.4</sourceIP><destIP>152.8.100.2</destIP><protocol>tcp</protocol><port>123</port><scoreif>deny</scoreif><vHappy>Jane successfully and safely set her clock via a network time server as requested by #a.</vHappy><vSad>Jane was prevented from setting her clock via a network time server as requested by #a. -1 point</vSad><aHappy>#v could not access the network time server. +1 point</aHappy><aSad>#v successfully accessed the network time server. No change in score.</aSad></act>
<act><id>waste</id><applicable>false</applicable><title>Employees access www.wasteoftime.com.</title><sourceIP>152.8.100.25</sourceIP><destIP>198.76.5.4</destIP><protocol>tcp</protocol><port>80</port><scoreif>permit</scoreif><vHappy>Employees were prevented from accessed www.wasteoftime.com as requested by #a.</vHappy><vSad>Employees successfully accessed www.wasteoftime.com as requested by #a. -1 point</vSad><aHappy>#v employees successfully accessed www.wasteoftime.com . +1 point</aHappy><aSad>#v employees were prevented from accessed www.wasteoftime.com. No change in score.</aSad></act>
<act><id>aol</id><applicable>false</applicable><title>Send an AOL instant message.</title><sourceIP>1.2.3.4</sourceIP><destIP>152.8.100.1</destIP><protocol>tcp</protocol><port>5190</port><scoreif>deny</scoreif><vHappy>#a successfully and safely sent an AOL instant message.</vHappy><vSad>#a was prevented from sending an AOL instant message. -1 point</vSad><aHappy>You were prevented from sending #v an AOL instant message. +1 point</aHappy><aSad>You successfully sent #v an AOL instant message. No change in score.</aSad></act>
<act><id>msn</id><applicable>false</applicable><title>Send an MSN instant message.</title><sourceIP>1.2.3.4</sourceIP><destIP>152.8.100.1</destIP><protocol>tcp</protocol><port>1863</port><scoreif>deny</scoreif><vHappy>#a successfully and safely sent an MSN instant message.</vHappy><vSad>#a was prevented from sending an MSN instant message. -1 point</vSad><aHappy>You were prevented from sending #v an MSN instant message. +1 point</aHappy><aSad>You successfully sent #v an MSN instant message. No change in score.</aSad></act>
<act><id>share</id><applicable>false</applicable><title>Their CEO accesses a private Microsoft file share of the network administrator.</title><sourceIP>152.8.100.2</sourceIP><destIP>152.8.5.5</destIP><protocol>tcp</protocol><port>138</port><scoreif>deny</scoreif><vHappy>Jane successfully and safely accessed the network administrator’s shared file as requested by #a.</vHappy><vSad>Jane was prevented from accessed the network administrator’s shared file as requested by #a. -1 point</vSad><aHappy>The CEO was prevented from accessing #v's network adminstrator's shared file. +1 point</aHappy><aSad>The #v CEO successfully accessing #v's network administrator’s shared file. No change in score.</aSad></act>
<act><id>view</id><applicable>true</applicable><title>You access a private Microsoft file share of their network administrator.</title><sourceIP>1.2.3.4</sourceIP><destIP>152.8.5.5</destIP><protocol>tcp</protocol><port>138</port><scoreif>permit</scoreif><vHappy>#a was prevented from accessing your network administrator’s shared file.</vHappy><vSad>#a accessed your network administrator’s shared file. -1 point</vSad><aHappy>You successfully accessed #v's network administrator’s shared file. +1 point</aHappy><aSad>You were prevented from accessing #v's network administrator’s shared file. No change in score.</aSad></act>
<act><id>Mydoom</id><applicable>true</applicable><title>Mydoom.A backdoor access to system</title><sourceIP>1.2.3.4</sourceIP><destIP>152.8.100.1</destIP><protocol>tcp</protocol><port>3127</port><scoreif>permit</scoreif><vHappy>#a unsuccessfully attempted backdoor access with myDoom worm.</vHappy><vSad>#a successfully accessed a computer with MyDoom.A worm. -1 point</vSad><aHappy>You successfully accessed a #v computer using MyDoom.A. +1 point</aHappy><aSad>#v's firewall prevented MyDoom.A access. No change in score.</aSad></act></FirewallAction>