Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV 1, Руководство пользователя

Страница: 88 / 246

STRM Users Guide
82 I
NVESTIGATING
O
FFENSES
Magnitude Specifies the relative importance of the offense. The magnitude
bar provides a visual representation of all the correlated
variables of the offense, attacker, target, or network. Variables
include Relevance, Severity, and Credibility. Point your mouse
to the magnitude bar to display the values and the calculated
magnitude.
Description Specifies a description of the offense.
Attacker/Src Specifies the IP address of the attacker. To view additional
information on the attacker, click the IP address.
For more information on attackers, see
Managing Offenses By
Attacker
.
Target(s)/Dest Specifies the local or remote target of the offense. To view
additional information on the target, click the IP address or term
that appears.
If the term local appears, click the term to view the local targets.
If the term remote appears, click the term to view the remote
targets.
For more information on targets, see
Managing Offenses By
Targets
Network(s) Specifies the targeted network for this offense. If the offense has
one targeted network, this field displays the network leaf. Click
the link to view the network information. If the offense has more
than one targeted network, the term Multiple appears. Click the
link to view additional details.
Notes Specifies any user notes on this offense. You can include up to
255 characters.
Relevance Specifies the relative importance of the offense.
Severity Specifies the severity of the offense. Severity indicates the
amount of threat than an attacker poses in relation to how
prepared the target is for the attack. This value is directly
mapped to the event category that is correlated to the offense.
For example, a Denial of Service (DoS) attack is always
considered a 10, which indicates a very severe occurrence.
Credibility Specifies the credibility of an offense, as determined by the
credibility rating from source devices. For example, credibility is
increased when multiple sources report the same event.
Event count Specifies the number of events that have occurred for this
offense in the number of event categories.
Start Specifies the date in which the first event occurred for this
offense.
Duration Specifies the amount of time since this offense was first
detected.
Table 5-3 Offense Details Panel (continued)
Parameter Description