23
©
SOLIDA SYSTEMS INTERNATIONAL
2016
7. Events and Event Severity
7.1 Event Overview
Each time a network packet registers a hit with a blacklist entry or a detection rule, an “event” is
generated. An event contains information that describes what caused the event to be generated.
The IP address of the offending packet is included, as well as a short description of the meaning of
the event and a timestamp.
Events are stored in a database in the appliance to allow for tracking and statistics gathering.
Events are also written to log files that can easily be downloaded from the appliance through the
GUI. These event files can then be correlated with other down loadable packet log files, so that a
security analyst can investigate the root cause of the event.
Events can be monitored using the built-in monitoring application.
Figure 7.1 Event summary view in the GUI monitoring application.
7.2 Event Severity
Events are grouped into three categories depending on their severity, which are Low, medium and
critical.
