Symantec 10268947 - Network Security 7160, User Manual

Page: 115 / 134

115 Reports and Queries
About top-level report types
Reports per Network Security device
Symantec Network Security generates the following types of device reports:
Note:
StandardUser can generate reports from devices with flow statistics; RestrictedUser
are not.
Event list by
destination IP This report lists all events by destination IP address for all
devices and interfaces in the network topology. You can generate
drill-down event lists by destination IP from Top Event
Destinations.
Event list by source
IP This report lists all events by source IP address for all devices and
interfaces in the network topology. You can generate drill-down
event lists by source IP from Top Event Sources.
Table 9-4 Types of event reports
Type Description
Table 9-5 Types of device reports
Type Description
Network Security
login history This report lists the user login times, IP addresses from which the
user logged in, and the type of user that logged in, either a
SuperUser with full read/write privileges, or one of the other user
login accounts with limited permissions.
Specify the report start and end dates/times. This report is
generated in table format only. This report has no drill-down
reports.
Network Security
operational events This report lists operational events such as user logins,
communication errors, response actions, and license status
notifications. This report allows you to drill-down to event
details.
Devices with flow
statistics This report lists names for devices on which the Flow Status
Collection sensor mode is enabled, and the number of the
software or appliance node where the sensor is located.
Symantec Network Security generates this report in table format
only. With a SuperUser, Administrator, or StandardUser account,
you can generate several drill-down reports for details on sources
and destination IP addresses and ports for the flows, as well as
flow protocols.