Enterasys Intrusion Prevention System, Руководство по отчетности

Страница: 79 / 122

Event Details
Enterasys IPS Analysis and Reporting Guide 7-3
• Packet Data — Shows the packet data of the event.
You can adjust the size of the pop-up window to better view the event information.
Table 7-1 describes the event details in the upper pane.
Table 7-1 Event Details Upper Pane
Field Description
Name Name of the event.
Date/Time Date and time of event occurrence.
Score The severity score of the event. The table can be filtered by score.
Source IP The source IP address of the event. Click the address link to
display a new browser window that attempts to resolve the IP
address using a DNS lookup. Additional publicly-available web
sites that perform address resolution are provided as links on the
browser page.
Port The source port.
Destination IP The destination IP address of the event. Click the address link to
display a new browser window that attempts to resolve the IP
address using a DNS lookup. Additional publicly-available web
sites that perform address resolution are provided as links on the
browser page.
Port The destination port.
Direction The direction of the event (for example, Internal or External).
Protocol The protocol used in the event.
Download PCAP Provides a download of a PCAP capture file. This file contains the
traffic between the source and destination IP addresses of the
event for the day the event was generated. Applicable to any TCP
event that supports the Dragon mktcpdump CLI tool.
Refer to
Chapter 8, Viewing a PCAP File for an Event for more
information.