Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 576 / 861

575 Field descriptions
Monitors field descriptions
IDS Alert Properties
The IDS Alert Properties dialog box lets you see the details of an IDS alert.
Associated tasks
The task that you can perform with this dialog box is:
■
“Monitoring IDS/IPS alerts” on page 482
Open Log Lets you open, delete, or back up an archived log file.
Current If you are viewing an archived log file, returns you to the current log file. If an old log file is
open (shown in the view), this opens the log file that is currently being written to.
This button is unavailable if you are already viewing the current log file.
Properties Lets you view the details of the selected IDS/IPS alert.
Search Lets you set conditions to search the log file and display a subset of IDS/IPS alert messages.
Clear Search Removes the search criteria and returns the IDS/IPS alerts table to a display of all alerts in
the log.
Table D-13 IDS Alert Properties
Field Description
Time Date and time stamp of when the intrusion occurred.
Type Event type.
IDS/IPS events always have the type Alert.
This indicates that a security rule has been triggered, and could potentially be an attempt to
breach the network perimeter.
Intrusion Event Name of the intrusion event.
Intrusion Policy Indicates the IDS/IPS policy currently being used.
All IDS/IPS policies are based on four heuristic detection levels, which are Low, Medium,
High, and Very High.
The security gateway includes the following pre-configured intrusion policies:
■
Low_Security
■
Medium_Security
■
High_Security
■
Very_High_Security
You can create your own intrusion detection and prevention policies by modifying these
policies.
Outcome The result of the intrusion detection:
■
Logged
The intrusion was detected and logged.
■
Dropped
The intrusion was detected, logged, and the connection was dropped.
Table D-12
IDS/IPS Alerts tab (Continued)
Field Description