Enterasys Intrusion Prevention System, Руководство по отчетности

Страница: 97 / 122

Legacy Reporting Using the Realtime Console
Enterasys IPS Analysis and Reporting Guide 11-9
Figure 11-7 Realtime Tool GraphEvents Displaying a Traffic Spike
EventDetail
The EventDetail event summary provides a simple listing of the raw events held in memory by the
Dragon Realtime Shell as shown in
Figure 11-8 . They are printed out from the most recent event to
the least recent event. If the number of events matching a query is greater than the number of
events in the Lines/Sessions filter value, a set of up to ten URLs are printed at the bottom of the
displayed HTML output. These URLs correspond to the successive groups of matching events.
Figure 11-8 Realtime EventDetail
For network-based events of either TCP or UDP protocols, clicking on the URL associated with the
source and destination address results in a Dragon Forensics Console mksession query and
displays the underlying network session. Clicking on the event type for any event (regardless if it