Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV 1, Руководство пользователя

Страница: 141 / 246

STRM Users Guide
Viewing Events 135
Viewing Events
By default, the Event Viewer interface displays normalized events. Initially, the
Event Viewer displays events that occurred during the previous minute and the
interface refreshes each minute.
You can sort the resulting tables by clicking on a column heading. A single click of
the desired column sorts the results in descending order and a second click on the
heading sorts the results in ascending order. An arrow at the top of the column
indicates the direction of the sort.
You can also view events using the following options:
• Viewing Normalized Events
•
Viewing Raw Events
•
Viewing Aggregate Normalized Events
Viewing Normalized
Events
To view normalized events:
Step 1
Click the Event Viewer tab.
The Event Viewer window appears.
Filter on Allows you to filter on the selected event, depending on the
selected item in the event. For example, if you right-click on a
Category of IP Protocol Anomaly, the following filter options
appear:
Filter on Category is IP Protocol Anomaly
Filter on Category is not IP Protocol Anomaly
View offense Allows you view the associated offense, if applicable.
False Positive Opens the False Positive Tuning window, which allows you to tune
out events that are known to be false positives from created
offenses. See
Tuning False Positives
.
Table 6-2 Right-Click Options (continued)
Button Description