Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 577 / 861

576 Field descriptions
Monitors field descriptions
IDS/IPS Alerts tab—Log Search properties—Search tab
The Log Search properties dialog box lets you specify criteria to reduce the number of IDS alert
messages that are displayed on the IDS/IPS Alerts tab.
The Search tab lets you specify search criteria such as source, destination, and time range.
Associated tasks
The task that you can perform with this dialog box is:
■
“Displaying selected IDS/IPS alerts” on page 484
:
Severity Displays the severity level of this event. Severity ratings describe the severity of the threat
that the event type covers.
The severity ratings are:
■
Informational
An informational severity level indicates an issue that is not generally considered
malicious, such as policy violations. This rating can also be used for event types that
detect authorized activity or provide troubleshooting information.
■
Low
A low severity level indicates reconnaissance tools, general malicious indicators, and
threats with a low impact.
■
Medium
A medium severity level indicates a threat that poses a medium risk, such as malicious
code execution as a normal user, moderate impact denial-of-service attacks, and
threats permitting write access to important data or read access to sensitive data.
■
High
A high severity level indicates a threat that poses a high risk, such as malicious code
execution as a privileged user, high impact denial-of-service attacks, and widespread
worms of moderate impact.
■
Critical
A critical severity level indicates a threat that poses a high risk, such as a Category 3 or
4 worm.
Reliability States the level of reliability regarding false positives. The scale for false positive reliability
is 1 to 10, with 1 indicating the least reliable and 10 indicating the most reliable.
Source IP IP address of the source of the intrusion.
Source Port Port number of the source of the intrusion.
Destination IP IP address of the destination of the intrusion.
Destination Port Port number of the destination of the intrusion.
IP Protocol IP protocol used in the intrusion.
Interface Name of the interface on which the intrusion was detected.
Table D-14 IDS/IPS Alerts tab—Log Search dialog box—Search tab
Field Description
Source IP address IP address of the source of the intrusion.
This option is unchecked by default.
Source port Port number of the source of the intrusion.
This option is unchecked by default.
Table D-13
IDS Alert Properties (Continued)
Field Description