Enterasys Intrusion Prevention System, Руководство по отчетности

Страница: 106 / 122

Using the Forensics Console Legacy Reporting
11-18 Enterasys IPS Analysis and Reporting Guide
Realtime Status
The Realtime Status option lists a variety of information about the Realtime console.
To display Realtime Console Status information:
1. Click Realtime Status in the top left navigation area.
The display area is populated with Realtime Status information.
Figure 11-20 Realtime Status Tool
Using the Forensics Console
The Dragon Forensics Console processes and displays event data collected in the Dragon
database. The Forensics Console can select a day of log data, for example, and produce a summary
of the collected events for that day, providing a list of events along with other data. You can also
produce a list of individual events in the database that match a selected event. In this list, each
event can have extra data displayed about it, such as the associated network session. The Forensics
tools provide many ways to view forensic data. Each tool contains a custom set of persistent filters
that allow you to quickly focus on a string of events. The tools available in the Forensics GUI
access the Dragon database and are also available using the command line (only to root
administrators as explained in the
Dragon Intrusion Defense System Configuration Guide ).
Reviewing Forensics
To access the Forensics Console Main Window and tools:
1. Click Forensics in the top right navigation area.
The Forensics Console main window appears as shown in Figure 11-21 . Navigation options
are shown in the left navigation panel.