Symantec 10521146 - Network Security 7120, Administration Manual

Page: 152 / 392

152 Responding
Setting response actions
6 In Configure Response Action , click OK to save and exit.
7 In Response Rules , click OK to save and exit.
Note: The Traffic Record and TrackBack response actions cannot run
simultaneously.
See “Playing recorded traffic” on page 240.
Setting a console response action
Symantec Network Security can initiate an action on the Network Security
console in response to an attack. A SuperUser or Administrator can configure
the response rule to play an alert sound and/or to execute a program on the
Network Security console. Any user can enable each Network Security console
individually to execute console response actions. The minimum delay between
responses is 1 minute.
To configure console response actions
1 In the Network Security console, click Configuration > Response Rules .
2 In Response Rules , click the Response Action column of a rule.
3 In Configure Response Action , click Console Response .
4 Provide the following information:
■
Limit Action to One Console : Click this to apply this response action to
a single Network Security console .
■
Play Alert Sound : Click this to sound an alert.
■
Execute Console Program : Click this to launch a program in response.
■
Start command : Enter the command to launch the response program.
■
Maximum # of executions : Enter the maximum number of executions
per incident of this response.
■
Delay between executions (mins) : Enter the time in minutes that you
want Symantec Network Security to wait between executions.
5 In Configure Response Action , click OK to save and exit.
6 In Response Rules , click OK to save and exit.
Enabling console response actions
You must enable console response actions on each Network Security console
individually.