Tuning Using Custom Rules Wizard - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV 1 Manual

14 SIM A O
UDIT FFENSES
Tuning Using Custom
Rules Wizard
Step 1
Step 2
Step 3
Step 4
Step 5
To tune SIM audit activity using the custom rules wizard:
In the navigation bar of the Offense Manager, click Rules.
The Rules interface appears.
Using the Display drop-down list box, select Building Blocks.
In the Block Name list, locate the Default-BB-HostDefinition: VA Scanner
Source IP building block.
From the Actions drop-down list box, select Edit.
The Rules Wizard appears.
In the Building Block section, click the IP address that appears.
A configuration window appears.
Category Offense Investigation Guide