Symantec 10268947 - Network Security 7160, User Manual

Page: 94 / 134

94 Incidents and Events
About incidents and events
About the Incidents tab
The Network Security console displays incident and event data in the following:
■
Incidents tab : Displays both active and idle incidents. When you select an
incident, Events At Selected Incident in the lower pane displays information
about the related events.
■
Devices tab : Displays the topology tree. When you select an object in the
topology tree, the Network Security console displays related information in
the right pane, including a link to security incidents that are currently
active on that object.
The Incidents tab provides a multi-level view of both incidents and events.
Incidents are groups of multiple related base events. Base events are the
representation of individual occurrences, either suspicious or operational. The
sensors notify the software or appliance node of any suspicious actions or
occurrences that might warrant a response, such as a probe. Symantec Network
Security also monitors operational occurrences that the user should be aware of,
such as a Symantec Network Security license approaching the expiration date.
The Incidents tab contains an upper and lower pane: Incidents , and Events at
Selected Incident . The upper pane displays information about each incident,
taken from the highest-priority event within that incident. The values may
change if an event of higher priority is added to the same incident.