Radware DefensePro 6.02, User Manual

Page: 293 / 339

DefensePro User Guide
Real-Time Security Reporting
Document ID: RDWR-DP-V0602_UG1201
293
Monitoring Attack Sources—Geographical Map
Attacks can originate from different locations around the world, for example, Web site attacks. Web
site administrators can track these attacks to see from which countries they originate.
You can generate a Top Attack Sources report for an individual device. This report displays a
geographical map of the world with indicators marking the country from which attacks originated,
based on their source IP address.
You can modify the report output by configuring the period of time over which the map displays
data, and the number of source countries to display.
The Top Attack Sources report also displays a summary table of attacks that originated from each
source country marked on the map, and you can view additional details for a selected source.
To view attack sources
1. In the Security Monitoring perspective navigation pane, select the device, or site, for which to
display data.
2. Select the GeoMap tab.
3. In the GeoMap pane, if required, change the display settings.
4. Click an attack source in the map to display more details in the Location Attacks List table.
(When no location is selected in the map, this table is empty.)
Protection Monitoring
Protection Monitoring provides the real-time traffic monitoring per network rule policy, either for the
network as a whole, if BDoS is configured, or for DNS traffic, if DNS is configured. The statistical
traffic information that Protection Monitoring provides can help you better understand the traffic that
flows through the protected network, how the configured protection is working, and, most
importantly, how anomalous traffic is detected.
For information about displaying protection information for a selected device, see the following:
• Displaying Attack Status Information, page 294
• Monitoring Network Rule Traffic, page 294
• Monitoring DNS Flood Attack Traffic, page 296
Table 133: GeoMap Display Settings
Parameter Description
Display Last The last number of hours for which the map displays information.
Values: 1, 2, 3, 6, 12, 24
Default: 1 hour
Top Sources to
Display The map displays the locations that have the highest number of attacks in
the database. You can set the number locations to display up to a maximum
of 20.
Default: 5
Total Plotted Attacks (Read-only) The number of attack source locations that are displayed. All
attacks that cannot be associated with any known location are considered as
originating from a single (unknown) location.