Enterasys Intrusion Prevention System, Руководство по отчетности

Страница: 100 / 122

Using the Realtime Console Legacy Reporting
11-12 Enterasys IPS Analysis and Reporting Guide
Figure 11-13 Realtime EventSummary (48-Hour Time line)
In this example, many events are observed to be active almost all of the time. This usually
indicates a high rate of false positives.
Figure 11-14 shows a more common output on a well-tuned Dragon Network Sensor. Notice the
trailing events and also a much less dense occurrence of any one event.
Figure 11-14 Realtime EventSummary (Well-Tuned)
Figure 11-15 Realtime EventSummary (IPS Events)