Enterasys Intrusion Prevention System, Руководство по отчетности, Страница: 112 / 122

Using the Trending Console Legacy Reporting
11-24 Enterasys IPS Analysis and Reporting Guide
3. Click Apply .
The table at the bottom of the display area is populated with the selected criteria.
The Reset button clears any selected data.
4. If desired, sort the data by clicking on a column header or the item name.
IP Address Summaries
You can manipulate data to show a variety of information that summarizes events by IP address.
To manipulate IP address summary data:
1. Click IP Address Summary in the top left navigation area.
The display area is populated with IP address Summary information in a display similar to
Event Summaries shown in
Event Summaries on page 11-22.
The activity summary Graph is at the top of the display area. For any query, the top seven
events are graphed over the specified query time period. Floating the mouse over the bar
graph reveals the actual number of events for the given event type. The graph can be shifted to
the left or right to expose hidden dates by clicking in the graph region and dragging the graph
left or right. To zoom in on a region of the graph, click on the graph while pressing the Ctrl
key and drag the mouse to select a region.
The top seven events are indexed in a legend to the left of the graph. Filtering certain events
can cause this graph and table to regenerate.
2. Select the desired information to view by clicking the navigation buttons and selecting the
desired item in the pulldown menu.
events Any set of events can be filtered positively or negatively. Short event names, such as
TCP, can be used to search for other events such as TCP-SWEEP and TCP-FRAG.
Clicking on the blue circle question mark also lists all of the current event types in the
database. Multiple events can be specified by using the character, &. For example,
data can be specified as WEB & TCP & DNS.
Table 11-4 Event Summary Options
Column or Item Description
Date Sort by date.
Event Name Sort the events alphabetically by name.
Event Name descriptor A description of that event’s signature.
# Events Rank events by their most common occurrence.
Event numbers The individual events that comprise the total. Upon clicking the number, the
Trending Console switches to the Event Detail tab and preloads all the
appropriate filter conditions. The query is then executed so that the event
detail is displayed for the selected line item.
Details Toggles the “Unique IPs and Most Active IPs” on and off.
Table 11-3 Event Summary Buttons (Continued)
Button Description