Symantec 10521146 - Network Security 7120, Administration Manual

Page: 208 / 392

208 Monitoring
Managing incident and event data
Annotating incident data
You can add comments to incidents and events. Each annotation receives a time
stamp and lists the author of the annotation. You can sort multiple annotations
for an event by time stamp in ascending or descending order.
To annotate an incident or event
1 On the Incidents tab, double-click an incident or event.
2 Click Analyst Note .
3 Enter the information relevant to this incident.
The
Note field can include guidelines established by the SuperUser, such as
ticket number, owner, and the last action taken in response to the event.
4 Click Add Note to preserve your annotation.
5 In Analyst Note , click Close to save and close.
Note: All users can annotate incident and event data. See “User groups
reference” on page 319 for more about permissions.
Customizing annotation templates
The Network Security console provides an informational template to make
Analyst Notes consistent and pertinent to your enterprise. For example, the
template can prompt for specific information such as identifying numbers or
last actions taken.
Note: SuperUsers and Administrators can create a template for Analyst Notes.
All users can use the template to annotate incident and event data. See “User
groups reference” on page 319 for more about permissions.
To create an annotation template
1 In the Network Security console, click Configuration >
Node
> Analyst Note
Template .
2 In Select Node , select the software or appliance node from the pull-down list
and click OK .
3 In the Analyst Note Template , edit the file with the boilerplate information
that you want to keep track of, and click OK to save and exit.