Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 485 / 861

484 Monitoring the security gateway
Monitoring IDS/IPS alerts
Displaying selected IDS/IPS alerts
Using the IDS/IPS Alert Search feature, you can control which kinds of IDS/IPS Alerts are displayed on
the IDS/IPS Alert tab.
Use the Log Search dialog box for IDS/IPS alerts for the following:
■
Performing a basic IDS/IPS alert search
■
Performing an advanced IDS/IPS alert search
Performing a basic IDS/IPS alert search
You can use the Search function on the IDS/IPS Alerts tab to control which events are displayed when
the log file is displayed on the IDS/IPS Alerts tab. You can perform a basic IDS/IPS alert search based
on the following criteria:
Prerequisites
None.
To perform a basic IDS/IPS alerts search
1 In the SGMI, in the left pane, under Monitors, click Logs .
2
In the right pane, click Search .
In the Log Search dialog box, on the Search tab, you can limit the alerts that are displayed by
checking one or more search criteria to be used.
The criteria are applied additively; only alerts that meet all of the search criteria are displayed in
the IDS/IPS Alerts table.
3 To display alerts that include a specific source IP address, check Source IP address , and then type
the IP address of the source of an intrusion.
4
To display alerts with a specific source port, check Source port , and then type the port number of
the source of the intrusion.
5 To display alerts that include a specific destination IP address, check Destination IP address , and
then type the IP address of the destination of an intrusion.
6
To display alerts with a specific destination port, check Destination port , and then type the port
number of the destination of the intrusion.
7 To create a time window within which to search, check Time, and then do the following:
■
Select a start time by using the hours and minutes drop-down lists and selecting AM or PM.
■
Set the duration of the search window using the hours and minutes drop-down lists.
Alternatively, you can use the sliders on the time line to specify a start time and duration. The
values in the drop-down lists change accordingly.
8 Click OK .
Source IP The IP address of the source of the intrusion.
Source Port The port number of the source of the intrusion.
Destination IP The IP address of the destination of the intrusion.
Destination Port The port number of the destination of the intrusion.
Time: Start The beginning of the time period specified for the search.
Time: Duration The duration of the search period.