Novell SENTINEL 6.1 SP2, User Manual, Page: 66 / 528

66 Sentinel 6.1 User Guide
no
vd
ocx
(e
n)
7 Ja
nua
ry 201
0
NOTE: Events that are sent directly to the database or dropped by a Global Filter is not processed
by the Correlation Engine.
When a rule fires, a correlated event is sent to the Sentinel Control Center, where it can be viewed in
the Active Views window.
Figure 3-1
Active View window
The correlated event can also trigger actions, such as sending an email with the correlated event’s
details or creating an incident associated with an iTRAC workflow.
3.1.1 Technical Implementation
All correlation is done in-memory on the machine (or machines) that host the correlation engine.
This model allows fast, distributed processing that does not contend with database operations such
as inserting events into the database.
For environments with large numbers of correlation rules or extremely high event rates, it might be
advantageous to install more than one correlation engine and redeploy some rules to the new
correlation engine. The ability to deploy multiple correlation engines provides the ability to scale as
the Sentinel system incorporates additional data sources or as event rates increase.
Sentinel’s correlation is near real-time and depends on the timestamp for the individual events. To
synchronize time, you can use an NTP (Network Time Protocol) server to synchronize the time on
all devices on your network, or you can rely on the time on the Collector Manager servers and
synchronize only those few machines.
Correlation relies on the data that is collected, parsed, and normalized by the Collectors, so a
working understanding of the data is necessary to write rules. Many Novell correlation rules rely on
an event taxonomy that ensures that a “failed login” and an “unsuccessful logon” from two devices
are classified the same.