Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 329 / 861

328 Preventing attacks
Blocking suspicious or malicious traffic with IDS
Viewing intrusion events in the tree format
In the tree format, events are displayed in a hierarchy, showing the severity levels for the selected
policy group. From the severity levels, you can expand down to show the IDS/IPS services and then the
individual intrusion events.
Figure 9-2
Viewing intrusion events in a tree format
You can determine whether an event is being logged by looking at the check box to the left of a severity
level, an IDS/IPS service, or an intrusion event. A check mark next to a severity level or an IDS/IPS
service indicates that all events for those groups are being logged. If the check box next to a severity
level or an IDS/IPS service appears grey rather than black, this indicates that some events below that
level in the hierarchy are not configured for logging.
At the individual intrusion event level, a red icon indicates the blocking status for these event types.
An open, target icon indicates that the event is not blocked. A red dot indicates that the event is
blocked.
Prerequisites
None.
To view intrusion events in the tree format
1 In the SGMI, in the left pane, under Policy, click IDS/IPS .
2 In the right pane, on the Configuration tab, next to View, click Tree .
3 In the Policy name drop-down list, select an IDS/IPS policy.
4 To the left of a severity level, click the arrow to expand down to the IDS/IPS service level.
5 To the left of the IDS/IPS service, click the arrow to expand down to the individual intrusion events.
6 Right-click the intrusion event you want to view.
7 To close the IDS Event Type Properties dialog box, click OK .