Strikeback is the part of the firewall that takes that information, and responds to the intrusion with swift and appropriate action.
An event is any abnormal security-related event. It does not necessarily indicate the presence of an intruder; it may mean that someone on the inside is attempting to reach a part of the network that is off-limits. While an event may be an intentional attempt to gain unauthorised access.

In some cases, the violation may not be severe enough to warrant any action beyond notification. But in some cases--such as the presence of an intruder or a malicious attack--immediate and automatic action must be taken.

Strikeback allows administrators to obtain all the information available about a potential intruder. When the administrator sets up the Strikeback function, he or she selects one or more of the following system commands:

• nslookup,
• finger,
• ping,
• whois,
• dig or
• traceroute .

The combination of event monitoring and Strikeback action provides an exceptionally powerful set of tools to the security administrator. Not only is it possible to gather information that can be analysed and used to proactively adjust policies to prevent future attacks, it also allows for an immediate response to be taken as those attacks occur.