Symantec 10521148 - Network Security 7161, Руководство по внедрению

Страница: 123 / 214

Chapter
9
Configuring detection and
response
This chapter includes the following topics:
■
About detection and response
■
Starting a sensor on an appliance interface
■
Creating and applying protection policies
■
About response rules
About detection and response
The fundamental purpose of Symantec Network Security is to detect malicious
traffic and respond in a way that helps protect your network. Network Security
sensor processes monitor traffic and detect suspicious events on each
monitoring interface, in-line pair, or interface group. The detected events are
handled according to policies that you apply.
You can also create and apply response rules for specific event types and source
or destination addresses. Response rules provide a means of automating actions
for Network Security to take when it detects the configured events.
Starting a sensor on an appliance interface
You must start a sensor on an interface, interface group, or in-line pair before
Symantec Network Security will detect traffic or attacks. Sensors function on a
per interface basis. It is possible for sensors to be running on some appliance
interfaces, and not running on others.
To start a sensor, you must apply a protection policy to the interface.