Symantec 10521146 - Network Security 7120, Administration Manual

Page: 196 / 392

196 Monitoring
Examining incident and event data
4 Click Close to close top Event Details.
From Event Details , you can do the following:
■
Annotating incident data
■
Copying an incident’s top event
Loading cross-node correlated events
If the selected incident is correlated to an incident from another software or
appliance node (as denoted in the
Other Node # column), then each tab of
Incident details will contain one sub-incident of the cross-node incident, and the
tab will carry the name of the node that detected that sub-incident.
To load events
◆
Click Load Events to load the events for the currently selected sub-incident.
Load Events will be disabled if the currently selected sub-incident's events
are already loaded.
Note:
SuperUsers and Administrators can drill down to view cross-node events.
See “User groups reference” on page 319 for more about permissions.
Examining event data
This section includes the following:
■
Viewing top-level event data
■
Detected At Indicates summary information about the event such as
the name of the software or appliance node on which
the event was detected, interface, current policy, and
MAC addresses.
■
Response Taken Indicates the response rule triggered by this incident.
■
Attack Details Provides detailed information about the event.
■
Event Message Indicates a summary information about the event.
■
Sources and
Destinations Indicates source and destination IP addresses and ports
of the packet that triggered the event.
■
Event Note Displays the optional note entered when the current
policy was created, if any.
See “Annotating an event type in a policy” on page 127.
■
Event name Indicates the name of the event.